A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).

The problem in particular is with the annotation " autoscaling.alpha.kubernetes.io/behavior" when it doesn't have a definition for scaling up, The cluster accepts the manifest but it seems that it fills with "nil" the scale up portion and it causes the kube-controller-manager pods to crash and go into crashloopbackoff.

The logs of the kube-controller-manager component show an error referencing invalid memory address or nil pointer dereference which causes the pod to die.