Kubernetes Kubelet must not disable timeouts.
An XCCDF Rule
Description
<VulnDiscussion>Idle connections from the Kubelet can be used by unauthorized users to perform malicious activity to the nodes, pods, containers, and cluster within the Kubernetes Control Plane. Setting the streamingConnectionIdleTimeout defines the maximum time an idle session is permitted prior to disconnect. Setting the value to "0" never disconnects any idle sessions. Idle timeouts must never be set to "0" and should be defined at "5m" (the default is 4hr).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-245541r961068_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
On the Control Plane, run the command:
ps -ef | grep kubelet
Remove the "--streaming-connection-idle-timeout" option if present.
Note the path to the config file (identified by --config).