2.1.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0

Information

Do not disable timeouts on streaming connections.

Rationale:

Setting idle timeouts ensures that you are protected against Denial-of-Service attacks, inactive connections and running out of ephemeral ports.

**Note:** By default, '--streaming-connection-idle-timeout' is set to 4 hours which might be too high for your environment. Setting this as appropriate would additionally ensure that such streaming connections are timed out after serving legitimate use cases.

Solution

If using a Kubelet config file, edit the file to set 'streamingConnectionIdleTimeout' to a value other than 0.

If using command line arguments, edit the kubelet service file '/etc/systemd/system/kubelet.service.d/10-kubeadm.conf' on each worker node and set the below parameter in 'KUBELET_SYSTEM_PODS_ARGS' variable.

--streaming-connection-idle-timeout=5m

Based on your system, restart the 'kubelet' service. For example:

systemctl daemon-reload
systemctl restart kubelet.service

See Also

https://workbench.cisecurity.org/files/2421

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, CSCv6|9

Plugin: Unix

Control ID: f9fc0b629176c7ad09475d0f50d2bae7510bc6e96d48eb09a357960eaae9cce3