Check: CNTR-K8-002600
Kubernetes STIG:
CNTR-K8-002600
(in versions v1 r6 through v1 r2)
Title
Kubernetes API Server must configure timeouts to limit attack surface. (Cat II impact)
Discussion
Kubernetes API Server request timeouts sets the duration a request stays open before timing out. Since the API Server is the central component in the Kubernetes Control Plane, it is vital to protect this service. If request timeouts were not set, malicious attacks or unwanted activities might affect multiple deployments across different applications or environments. This might deplete all resources from the Kubernetes infrastructure causing the information system to go offline. The request-timeout value must never be set to "0". This disables the request-timeout feature. By default, the request-timeout is set to "1 minute".
Check Content
Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master Node. Run the command: grep -I request-timeout * If Kubernetes API Server manifest file does not exist, this is a finding. If the setting request-timeout is set to "0" in the Kubernetes API Server manifest file, or is not configured this is a finding.
Fix Text
Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the value of request-timeout greater than "0".
Additional Identifiers
Rule ID: SV-242438r754802_rule
Vulnerability ID: V-242438
Group Title: SRG-APP-000435-CTR-001070
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-002385 |
The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards. |
Controls
Number | Title |
---|---|
SC-5 |
Denial Of Service Protection |