cyberstrikeus CIS Kubernetes Benchmark v1.12.0 - Control 4.2.5
Description
Do not disable timeouts on streaming connections.
Rationale
Setting idle timeouts ensures that you are protected against Denial-of-Service attacks, inactive connections and running out of ephemeral ports.
Note: By default, --streaming-connection-idle-timeout is set to 4 hours which might be too high for your environment. Setting this as appropriate would additionally ensure that such streaming connections are timed out after serving legitimate use cases.
Impact
Long-lived connections could be interrupted.
Audit Procedure
Step 1: Verify via process arguments
Run the following command on each node:
ps -ef | grep kubelet
Verify that the --streaming-connection-idle-timeout argument is not set to 0.
If the argument is not present, and there is a Kubelet config file specified by --config, check that it does not set streamingConnectionIdleTimeout to 0.
Remediation
If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a value other than 0.
If using command line arguments, edit the kubelet service file /etc/kubernetes/kubelet.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--streaming-connection-idle-timeout=5m
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
Default Value
By default, --streaming-connection-idle-timeout is set to 4 hours.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 10.5 Enable Anti-Exploitation FeaturesEnable anti-exploitation features on enterprise assets and software, where possible. | ● | ● | |
| v7 | 8.3 Enable Operating System Anti-Exploitation Features/Deploy Anti-Exploit TechnologiesEnable anti-exploitation features such as Data Execution Prevention (DEP) or Address Space Layout Randomization (ASLR). | ● | ● |
Profile Applicability
- Level 1 - Worker Node
Assessment Status
Manual