documentation_complete: true


title: 'kubelet - Do Not Disable Streaming Timeouts'

description: |-
    Timouts for streaming connections should not be disabled as they help to prevent
    denial-of-service attacks.
    To configure streaming connection timeouts
    To set the <tt>streamingConnectionIdleTimeout</tt> option for the kubelet,
    create a <tt>KubeletConfig</tt> option along these lines:
    <pre>
    apiVersion: machineconfiguration.openshift.io/v1
    kind: KubeletConfig
    metadata:
       name: kubelet-config-$pool
    spec:
        machineConfigPoolSelector:
            matchLabels:
                pools.operator.machineconfiguration.openshift.io/$pool_name: ""
        kubeletConfig:
            streamingConnectionIdleTimeout: {{{ xccdf_value("var_streaming_connection_timeouts") }}}
    </pre>

rationale: |-
    Ensuring connections have timeouts helps to protect against denial-of-service attacks as
    well as disconnect inactive connections. In addition, setting connections timeouts helps
    to prevent from running out of ephemeral ports.

severity: medium

platform: {{{ product }}}-node

ocil_clause: 'the streaming connection timeouts are not disabled'

ocil: |-
    Run the following command on the kubelet node(s):
    <pre>$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep streamingConnectionIdleTimeout; done</pre>
    The output should not return <tt>0</tt>.

identifiers:
    cce@ocp4: CCE-84097-5

references:
    cis@eks: 3.2.5
    cis@ocp4: 4.2.6
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    srg: SRG-APP-000516-CTR-001325

template:
    name: yamlfile_value
    vars:
        filepath: '/etc/kubernetes/compliance-operator/kubeletconfig/openscap-kubeletconfig'
        yamlpath: ".kubeletconfig.streamingConnectionIdleTimeout"
        check_existence: "all_exist"
        values:
         - value: "0s"
           operation: "not equal"
