| name | cis-oke-v180-3.2.5 |
| description | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated) |
| category | cis-oke |
| version | 1.8.0 |
| author | cyberstrike-official |
| tags | ["cis","oke","kubernetes","oci","worker-node","kubelet"] |
| cis_id | 3.2.5 |
| cis_benchmark | CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v1.8.0 |
| tech_stack | ["kubernetes","oci","oke"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
CIS OKE Benchmark v1.8.0 - Control 3.2.5
Profile Applicability
Description
Do not disable timeouts on streaming connections.
Rationale
Setting idle timeouts ensures that you are protected against Denial-of-Service attacks, inactive connections and running out of ephemeral ports.
Note: By default, --streaming-connection-idle-timeout is set to 4 hours which might be too high for your environment. Setting this as appropriate would additionally ensure that such streaming connections are timed out after serving legitimate use cases.
Impact
Long-lived connections could be interrupted.
Audit Procedure
Audit Method 1
If using a Kubelet configuration file, check that there is an entry for --streaming-connection-idle-timeout is not set to 0.
First, SSH to the relevant node.
Run the following command on each node to find the appropriate Kubelet config file:
find / -name kubelet.service
The output of the above command should return the file and location /etc/systemd/system/kublet.service which is the location of the Kubelet service config file.
Open the Kubelet service config file:
sudo more etc/systemd/system/kubelet.service
Verify that the --streaming-connection-idle-timeout argument is not set to 0.
Audit Method 2
If using the api configz endpoint consider searching for the status of "streamingConnectionIdleTimeout":"4h0m0s" by extracting the live configuration from the nodes running kubelet.
Set the local proxy port and the following variables and provide proxy port number and node name:
kubectl proxy --port=8001 &
export HOSTNAME_PORT=localhost:8001 (example host and port number)
export NODE_NAME=10.0.10.4 (example node name from "kubectl get nodes")
curl -sSL "http://${HOSTNAME_PORT}/api/v1/nodes/${NODE_NAME}/proxy/configz"
Remediation
Remediation Method 1
If modifying the Kubelet service config file, edit the kubelet.service file and set the below parameter:
