Check: CNTR-K8-001300
Kubernetes STIG:
CNTR-K8-001300
(in versions v1 r4 through v1 r1)
Title
Kubernetes Kubelet must not disable timeouts. (Cat II impact)
Discussion
Idle connections from the Kubelet can be use by unauthorized users to perform malicious activity to the nodes, pods, containers, and cluster within the Kubernetes Control Plane. Setting the streaming connection idle timeout defines the maximum time an idle session is permitted prior to disconnect. Setting the value to "0" never disconnects any idle sessions. Idle timeouts must never be set to "0" and should be defined at a minimum of "5 minutes".
Check Content
Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run the command: grep -i streaming-connection-idle-timeout kubelet If the setting streaming-connection-idle-timeout is set to "0" or the parameter is not configured in the Kubernetes Kubelet, this is a finding.
Fix Text
Edit the Kubernetes Kubelet file in the /etc/sysconfig directory on the Kubernetes Master Node. Set the argument "--streaming-connection-idle-timeout" to a value other than "0". Reset Kubelet service using the following command: service kubelet restart
Additional Identifiers
Rule ID: SV-245541r754888_rule
Vulnerability ID: V-245541
Group Title: SRG-APP-000190-CTR-000500
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001133 |
Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity. |
Controls
Number | Title |
---|---|
SC-10 |
Network Disconnect |