2.1.6 Ensure that the --streaming-connection-idle-timeout argument is not set to 0

Information

Do not disable timeouts on streaming connections.

Rationale:

Setting idle timeouts ensures that you are protected against Denial-of-Service attacks, inactive connections and running out of ephemeral ports.

Note: By default, `--streaming-connection-idle-timeout` is set to 4 hours which might be too high for your environment. Setting this as appropriate would additionally ensure that such streaming connections are timed out after serving legitimate use cases.

Solution

Edit the `/etc/kubernetes/kubelet` file on each node and set the `KUBELET_ARGS` parameter to `'--streaming-connection-idle-timeout='`: `KUBELET_ARGS='--streaming-connection-idle-timeout=5m'`

Based on your system, restart the `kubelet` service. For example: `systemctl restart kubelet.service`

Impact:

Long-lived connections could be interrupted.

See Also

https://workbench.cisecurity.org/files/1738

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, CSCv6|9

Plugin: Unix

Control ID: 9ce0c9dbb606b3ee5b7370b32f38e43b0ddedd4d0b703252b9763c3d791fbe27