Kubernetes API Server must configure timeouts to limit attack surface.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-242438	CNTR-K8-002600	SV-242438r961620_rule	CCI-002415	medium
Description
Kubernetes API Server request timeouts sets the duration a request stays open before timing out. Since the API Server is the central component in the Kubernetes Control Plane, it is vital to protect this service. If request timeouts were not set, malicious attacks or unwanted activities might affect multiple deployments across different applications or environments. This might deplete all resources from the Kubernetes infrastructure causing the information system to go offline. The "--request-timeout" value must never be set to "0". This disables the request-timeout feature. (By default, the "--request-timeout" is set to "1 minute".)
STIG			Date
Kubernetes Security Technical Implementation Guide			2025-05-16

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-03.7Isolation of System Components

1.00

DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SC-5(1)Restrict Ability to Attack Other Systems

1.00

DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R6our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-7(21)Isolation of System Components

1.00

DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CCI1 mapping

CCI-002415

1.00

DISA STIG Benchmark (XCCDF)2intersects(normalised)

Details

Check Text (C-242438r961620_chk)

Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Control Plane. Run the command: grep -I request-timeout * If Kubernetes API Server manifest file does not exist, this is a finding. If the setting "--request-timeout" is set to "0" in the Kubernetes API Server manifest file, or is not configured this is a finding.

Fix Text (F-45671r927127_fix)

Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Control Plane. Set the value of "--request-timeout" greater than "0".