cis-ocp-v170-4-2-1

name	cis-ocp-v170-4.2.1
description	Activate Garbage collection in OpenShift Container Platform 4, as appropriate (Manual)
category	cis-openshift
version	1.7.0
author	cyberstrike-official
tags	["cis","openshift","kubernetes","redhat","worker-node","kubelet"]
cis_id	4.2.1
cis_benchmark	CIS Red Hat OpenShift Container Platform Benchmark v1.7.0
tech_stack	["kubernetes","openshift","redhat"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 4.2.1

Profile Applicability

• Level: 1

Description

Configure garbage collection for containers and images as appropriate.

Rationale

Garbage collection is important to ensure sufficient resource availability and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection.

Impact

Incorrect configuration of garbage collection parameters can lead to system instability, degraded performance, and in worst cases, system crashes. Properly set parameters ensure efficient utilization of system resources.

Audit Procedure

Two types of garbage collection are performed on an OpenShift Container Platform node:

• Container garbage collection: Removes terminated containers.
• Image garbage collection: Removes images not referenced by any running pods.

Container garbage collection can be performed using eviction thresholds. Image garbage collection relies on disk usage as reported by cAdvisor on the node to decide which images to remove from the node. The OpenShift administrator can configure how OpenShift Container Platform performs garbage collection by creating a kubeletConfig object for each Machine Config Pool using any combination of the following:

• soft eviction, which evicts containers based on eviction settings and a grace period
• hard eviction, which evicts containers based on eviction settings without a grace period
• eviction for images

To configure, follow the directions in Freeing Node Resources Using Garbage Collection.

To verify settings, run the following command for each updated configpool. To verify, you can inspect the configuration of each node individually:

for node in $(oc get nodes -ojsonpath='{.items[*].metadata.name}')
do
  oc get --raw /api/v1/nodes/$node/proxy/configz | jq '.kubeletconfig'
done

You can verify the values of the evictionHard settings. Verify the values for the following are set as appropriate: