Skip to content

0425-k8s-idle-timeout-Do Not Set the Streaming Connection Idle Timeout Parameter to 0

Rule ID

  • 0425-k8s-idle-timeout

Category

  • container

Level

  • info

Compatible Versions

  • Linux

Description

  • Do not disable the timeout on streaming connections.

Scan Frequency

  • 0 */30 * * *

Rationale

  • Setting an idle timeout helps protect against denial-of-service attacks, inactive connections, and ephemeral port exhaustion.

Risk Items

  • Container Security

Audit Method

  • Run the following command to verify:
ps -ef | grep kubelet |grep streaming-connection-idle-timeout

Remediation

  • The kubelet can be started in two ways.

Check if the configuration file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf exists. If it does, set the parameter --streaming-connection-idle-timeout=5m.

If the file does not exist, check the kubelet startup parameter -config. Open the file and verify if the parameter streamingConnectionIdleTimeout exists and is set to 0.

After making the changes, restart kubelet:

systemctl daemon-reload
systemctl restart kubelet.service

Impact

  • Long-lived connections may be interrupted.

Default Value

  • By default, --streaming-connection-idle-timeout is set to 4 hours.

References

CIS Controls

  • None

Feedback

Is this page helpful?