Kubernetes Kubelet must not disable timeouts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-245541	CNTR-K8-001300	SV-245541r918210_rule		Medium

Description
Idle connections from the Kubelet can be used by unauthorized users to perform malicious activity to the nodes, pods, containers, and cluster within the Kubernetes Control Plane. Setting the streamingConnectionIdleTimeout defines the maximum time an idle session is permitted prior to disconnect. Setting the value to "0" never disconnects any idle sessions. Idle timeouts must never be set to "0" and should be defined at "5m" (the default is 4hr).

Description

Idle connections from the Kubelet can be used by unauthorized users to perform malicious activity to the nodes, pods, containers, and cluster within the Kubernetes Control Plane. Setting the streamingConnectionIdleTimeout defines the maximum time an idle session is permitted prior to disconnect. Setting the value to "0" never disconnects any idle sessions. Idle timeouts must never be set to "0" and should be defined at "5m" (the default is 4hr).

STIG	Date
Kubernetes Security Technical Implementation Guide	2023-08-29

Details

Check Text ( C-48816r918208_chk )
On the Control Plane, run the command: ps -ef \| grep kubelet If the "--streaming-connection-idle-timeout" option exists, this is a finding. Note the path to the config file (identified by --config). Run the command: grep -i streamingConnectionIdleTimeout If the setting "streamingConnectionIdleTimeout" is set to less than "5m" or is not configured, this is a finding.

Fix Text (F-48771r918209_fix)
On the Control Plane, run the command: ps -ef \| grep kubelet Remove the "--streaming-connection-idle-timeout" option if present. Note the path to the config file (identified by --config). Edit the Kubernetes Kubelet file in the --config directory on the Kubernetes Control Plane: Set the argument "streamingConnectionIdleTimeout" to a value of "5m". Reset the kubelet service using the following command: service kubelet restart

Fix Text (F-48771r918209_fix)

On the Control Plane, run the command:
ps -ef | grep kubelet

Remove the "--streaming-connection-idle-timeout" option if present.

Note the path to the config file (identified by --config).

Edit the Kubernetes Kubelet file in the --config directory on the Kubernetes Control Plane:

Set the argument "streamingConnectionIdleTimeout" to a value of "5m".

Reset the kubelet service using the following command:
service kubelet restart