Imported from node011/Bounty-Reaper (
.bountyreper/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_Kubernetes_Benchmark_v2.0.0/cis-k8s-v200-4.2.5/SKILL.md). Install upstream withnpx skills add node011/Bounty-Reaper --skill cis-k8s-v200-4.2.5. Copyright stays with the author (CC-BY-NC-SA-4.0).
4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)
Profile Applicability
- Level 1 - Worker Node
Description
Do not disable timeouts on streaming connections.
Rationale
Setting idle timeouts ensures that you are protected against Denial-of-Service attacks, inactive connections and running out of ephemeral ports.
Note: By default, --streaming-connection-idle-timeout is set to 4 hours which might be too high for your environment. Setting this as appropriate would additionally ensure that such streaming connections are timed out after serving legitimate use cases.
Impact
Long-lived connections could be interrupted.
Audit
Run the following command on each node:
ps -ef | grep kubeletVerify that the --streaming-connection-idle-timeout argument is not set to 0.
If the argument is not present, and there is a Kubelet config file specified by --config, check that it does not set streamingConnectionIdleTimeout to 0.
Remediation
If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a value other than 0.
If using command line arguments, edit the kubelet service file /etc/kubernetes/kubelet.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--streaming-connection-idle-timeout=5mBased on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.serviceDefault Value
By default, --streaming-connection-idle-timeout is set to 4 hours.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 10.5 Enable Anti-Exploitation Features - Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft Data Execution Prevention (DEP), Windows Defender Exploit Guard (WDEG), or Apple System Integrity Protection (SIP) and Gatekeeper. | * | * | |
| v7 | 8.3 Enable Operating System Anti-Exploitation Features/Deploy Anti-Exploit Technologies - Enable anti-exploitation features such as Data Execution Prevention (DEP) or Address Space Layout Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that can be configured to apply protection to a broader set of applications and executables. | * | * |