2.1.6 Ensure that the --streaming-connection-idle-timeout argument is not set to 0

Information

Do not disable timeouts on streaming connections.

Rationale:

Setting idle timeouts ensures that you are protected against Denial-of-Service attacks, inactive connections and running out of ephemeral ports.

**Note:** By default, '--streaming-connection-idle-timeout' is set to 4 hours which might be too high for your environment. Setting this as appropriate would additionally ensure that such streaming connections are timed out after serving legitimate use cases.

Solution

Edit the kubelet service file '/etc/systemd/system/kubelet.service.d/10-kubeadm.conf' on each worker node and set the below parameter in 'KUBELET_SYSTEM_PODS_ARGS' variable.

--streaming-connection-idle-timeout=5m

Based on your system, restart the 'kubelet' service. For example:

systemctl daemon-reload
systemctl restart kubelet.service

Impact:

Long-lived connections could be interrupted.

See Also

https://workbench.cisecurity.org/files/2125

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, CSCv6|9

Plugin: Unix

Control ID: 8363032240a76253e9d0d3a5da69274657ec2411b24af601c38416e7eb36bfdd