cis-oke-v150-3-2-5

name	cis-oke-v150-3.2.5
description	Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated)
category	cis-oke
version	1.5.0
author	cyberstrike-official
tags	["cis","oke","kubernetes","oci","worker-node","kubelet"]
cis_id	3.2.5
cis_benchmark	CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v1.5.0
tech_stack	["kubernetes","oci","oke"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

3.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated)

Profile Applicability

• Level 1

Description

Do not disable timeouts on streaming connections.

Rationale

Setting idle timeouts ensures that you are protected against Denial-of-Service attacks, inactive connections and running out of ephemeral ports.

Note: By default, --streaming-connection-idle-timeout is set to 4 hours which might be too high for your environment. Setting this as appropriate would additionally ensure that such streaming connections are timed out after serving legitimate use cases.

Impact

Long-lived connections could be interrupted.

Audit Procedure

Audit Method 1: If using a Kubelet configuration file, check that there is an entry for --streaming-connection-idle-timeout is not set to 0. First, SSH to the relevant node: Run the following command on each node to find the appropriate Kubelet config file:

find / -name kubelet.service

The output of the above command should return the file and location /etc/systemd/system/kublet.service which is the location of the Kubelet service config file. Open the Kubelet service config file:

sudo more etc/systemd/system/kublet.service

Verify that the --streaming-connection-idle-timeout argument is not set to 0.

Audit Method 2: If using the api configz endpoint consider searching for the status of "streamingConnectionIdleTimeout":"4h0m0s" by extracting the live configuration from the nodes running kubelet. Set the local proxy port and the following variables and provide proxy port number and node name; HOSTNAME_PORT="localhost-and-port-number" NODE_NAME="The-Name-Of-Node-To-Extract-Configuration" from the output of "kubectl get nodes"

kubectl proxy --port=8001 &

export HOSTNAME_PORT=localhost:8001 (example host and port number)
export NODE_NAME=10.0.10.4 (example node name from "kubectl get nodes")

curl -sSL "http://${HOSTNAME_PORT}/api/v1/nodes/${NODE_NAME}/proxy/configz"