0429-k8s-qps - The event-qps flag on Kubernetes can be used to limit the rate of event collection¶

Rule ID¶

• 0429-k8s-qps

Category¶

• Container

Level¶

• info

Compatible Versions¶

• Linux

Description¶

• The event-qps flag on Kubernetes can be used to limit the rate of event collection. Setting it too low may cause relevant events not to be recorded, but setting it to 0 may lead to a Denial of Service (DoS) on Kubernetes.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Capture all events without limiting event creation. Events are an important source of security information and analysis, ensuring that your environment is consistently monitored using event data.

Risk Item¶

• Container Security

Audit Method¶

• Execute the following command to verify:

ps -ef | grep kubelet |grep event-qps

Remediation¶

• There are two ways to start kubelet: Check if the configuration file exists: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf. If the file exists, add the parameter --event-qps=5. If the file does not exist, kubelet is started via command line. Check the kubelet startup parameter -config, open the file and check if the parameter eventRecordQPS exists. Set it to 5 or higher.

After configuration, restart kubelet:

systemctl daemon-reload
systemctl restart kubelet.service

Impact¶

• Setting this parameter to 0 may cause a Denial of Service (DoS) condition due to excessive event creation. The cluster's event processing and storage system should be scaled to handle the expected event load.

Default Value¶

• Default: --event-qps=5

References¶

• kubelet

CIS Controls¶

• None