Skip to content
ATO Pathways
  Log In

kubelet - Do Not Disable Streaming Timeouts

An XCCDF Rule

Description

Timouts for streaming connections should not be disabled as they help to prevent denial-of-service attacks. To configure streaming connection timeouts To set the streamingConnectionIdleTimeout option for the kubelet, create a KubeletConfig option along these lines: 

apiVersion: machineconfiguration.openshift.io/v1
kind: KubeletConfig
metadata:
   name: kubelet-config-$pool
spec:
    machineConfigPoolSelector:
        matchLabels:
            pools.operator.machineconfiguration.openshift.io/$pool_name: ""
    kubeletConfig:
        streamingConnectionIdleTimeout:

Rationale

Ensuring connections have timeouts helps to protect against denial-of-service attacks as well as disconnect inactive connections. In addition, setting connections timeouts helps to prevent from running out of ephemeral ports.

ID
xccdf_org.ssgproject.content_rule_kubelet_enable_streaming_connections
Severity
Medium
References
Updated



Remediation - Kubernetes Patch

---
apiVersion: machineconfiguration.openshift.io/v1
kind: KubeletConfig
spec:
  kubeletConfig:
    streamingConnectionIdleTimeout: {{.var_streaming_connection_timeouts}}