CIS OKE Benchmark v1.8.0 - Control 3.2.5
Profile Applicability
Description
Do not disable timeouts on streaming connections.
Rationale
Setting idle timeouts ensures that you are protected against Denial-of-Service attacks, inactive connections and running out of ephemeral ports.
Note: By default, --streaming-connection-idle-timeout is set to 4 hours which might be too high for your environment. Setting this as appropriate would additionally ensure that such streaming connections are timed out after serving legitimate use cases.
Impact
Long-lived connections could be interrupted.
Audit Procedure
Audit Method 1
If using a Kubelet configuration file, check that there is an entry for --streaming-connection-idle-timeout is not set to 0.
First, SSH to the relevant node.
Run the following command on each node to find the appropriate Kubelet config file:
find / -name kubelet.service
The output of the above command should return the file and location /etc/systemd/system/kublet.service which is the location of the Kubelet service config file.
Open the Kubelet service config file:
sudo more etc/systemd/system/kubelet.service
Verify that the --streaming-connection-idle-timeout argument is not set to 0.
Audit Method 2
If using the api configz endpoint consider searching for the status of "streamingConnectionIdleTimeout":"4h0m0s" by extracting the live configuration from the nodes running kubelet.
Set the local proxy port and the following variables and provide proxy port number and node name:
kubectl proxy --port=8001 &
export HOSTNAME_PORT=localhost:8001 (example host and port number)
export NODE_NAME=10.0.10.4 (example node name from "kubectl get nodes")
curl -sSL "http://${HOSTNAME_PORT}/api/v1/nodes/${NODE_NAME}/proxy/configz"
Remediation
Remediation Method 1
If modifying the Kubelet service config file, edit the kubelet.service file /etc/systemd/system/kubelet.service and set the below parameter:
--streaming-connection-idle-timeout
Remediation Method 2
If using the api configz endpoint consider searching for the status of "streamingConnectionIdleTimeout": by extracting the live configuration from the nodes running kubelet.
See detailed step-by-step configmap procedures in Reconfigure a Node's Kubelet in a Live Cluster, and then rerun the curl statement from audit process to check for kubelet configuration changes.
kubectl proxy --port=8001 &
export HOSTNAME_PORT=localhost:8001 (example host and port number)
export NODE_NAME=10.0.10.4 (example node name from "kubectl get nodes")
curl -sSL "http://${HOSTNAME_PORT}/api/v1/nodes/${NODE_NAME}/proxy/configz"
For all remediations: Based on your system, restart the kubelet service and check status:
systemctl daemon-reload
systemctl restart kubelet.service
systemctl status kubelet -l
Default Value
See the OKE documentation for the default value.
References
- https://kubernetes.io/docs/admin/kubelet/
- https://github.com/kubernetes/kubernetes/pull/18552
- https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|
| v8 | 10.5 Enable Anti-Exploitation Features | | * | * |
| v7 | 8.3 Enable Operating System Anti-Exploitation Features / Deploy Anti-Exploit Technologies | | * | * |
MITRE ATT&CK Mappings
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|
| T1490 | TA0040 | M1028 |
Profile
Level 1 (Automated)
