Menu
Activate Garbage collection in OpenShift Container Platform 4, as appropriate (Manual)
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ocp-v170-4-2-1The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-ocp-v170-4.2.1 |
| description | Activate Garbage collection in OpenShift Container Platform 4, as appropriate (Manual) |
| category | cis-openshift |
| version | 1.7.0 |
| author | cyberstrike-official |
| tags | ["cis","openshift","kubernetes","redhat","worker-node","kubelet"] |
| cis_id | 4.2.1 |
| cis_benchmark | CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 |
| tech_stack | ["kubernetes","openshift","redhat"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Configure garbage collection for containers and images as appropriate.
Garbage collection is important to ensure sufficient resource availability and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection.
Incorrect configuration of garbage collection parameters can lead to system instability, degraded performance, and in worst cases, system crashes. Properly set parameters ensure efficient utilization of system resources.
Two types of garbage collection are performed on an OpenShift Container Platform node:
Container garbage collection can be performed using eviction thresholds. Image garbage collection relies on disk usage as reported by cAdvisor on the node to decide which images to remove from the node. The OpenShift administrator can configure how OpenShift Container Platform performs garbage collection by creating a kubeletConfig object for each Machine Config Pool using any combination of the following:
To configure, follow the directions in Freeing Node Resources Using Garbage Collection.
To verify settings, run the following command for each updated configpool. To verify, you can inspect the configuration of each node individually:
for node in $(oc get nodes -ojsonpath='{.items[*].metadata.name}')
do
oc get --raw /api/v1/nodes/$node/proxy/configz | jq '.kubeletconfig'
done
You can verify the values of the evictionHard settings. Verify the values for the following are set as appropriate:
evictionHardevictionPressureTransitionPeriodimageMinimumGCAgeimageGCHighThresholdPercentimageGCLowThresholdPercentevictionSoft (if configured)evictionSoftGracePeriod (if configured)To configure, follow the directions in Garbage Collection Remediation.
The kubelet has the following default hard eviction thresholds:
{
"imagefs.available": "15%",
"memory.available": "100Mi",
"nodefs.available": "10%",
"nodefs.inodesFree": "5%"
}
Note: These default values of hard eviction thresholds will only be set if none of the parameters is changed. If you changed the value of any parameter, then the values of other parameters will not be inherited as the default values and will be set to zero. In order to provide custom values, you should provide all the thresholds respectively.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 10.5 Enable Anti-Exploitation Features | * | * | |
| v7 | 5.1 Establish Secure Configurations | * | * | * |
None specified.
Level 1 (Manual)