Separate the bind address for the healthz server from the bind address from

cmd/kube-proxy/app/server.go

@@ -38,18 +38,20 @@ import (
 
 // ProxyServer contains configures and runs a Kubernetes proxy server
 type ProxyServer struct {
-	BindAddress  util.IP
-	ClientConfig client.Config
-	HealthzPort  int
-	OOMScoreAdj  int
+	BindAddress        util.IP
+	ClientConfig       client.Config
+	HealthzPort        int
+	HealthzBindAddress util.IP
+	OOMScoreAdj        int
 }
 
 // NewProxyServer creates a new ProxyServer object with default parameters
 func NewProxyServer() *ProxyServer {
 	return &ProxyServer{
-		BindAddress: util.IP(net.ParseIP("0.0.0.0")),
-		HealthzPort: 10249,
-		OOMScoreAdj: -899,
+		BindAddress:        util.IP(net.ParseIP("0.0.0.0")),
+		HealthzPort:        10249,
+		HealthzBindAddress: util.IP(net.ParseIP("127.0.0.1")),
+		OOMScoreAdj:        -899,
 	}
 }
 
@@ -58,6 +60,7 @@ func (s *ProxyServer) AddFlags(fs *pflag.FlagSet) {
 	fs.Var(&s.BindAddress, "bind_address", "The IP address for the proxy server to serve on (set to 0.0.0.0 for all interfaces)")
 	client.BindClientConfigFlags(fs, &s.ClientConfig)
 	fs.IntVar(&s.HealthzPort, "healthz_port", s.HealthzPort, "The port to bind the health check server. Use 0 to disable.")
+	fs.Var(&s.HealthzBindAddress, "healthz_bind_address", "The IP address for the health check server to serve on, defaulting to 127.0.0.1 (set to 0.0.0.0 for all interfaces)")
 	fs.IntVar(&s.OOMScoreAdj, "oom_score_adj", s.OOMScoreAdj, "The oom_score_adj value for kube-proxy process. Values must be within the range [-1000, 1000]")
 }
 
@@ -107,7 +110,7 @@ func (s *ProxyServer) Run(_ []string) error {
 
 	if s.HealthzPort > 0 {
 		go util.Forever(func() {
-			err := http.ListenAndServe(s.BindAddress.String()+":"+strconv.Itoa(s.HealthzPort), nil)
+			err := http.ListenAndServe(s.HealthzBindAddress.String()+":"+strconv.Itoa(s.HealthzPort), nil)
 			if err != nil {
 				glog.Errorf("Starting health server failed: %v", err)
 			}