API server enables the EventRateLimit admission plugin

​

What this check verifies

Kubernetes API server includes EventRateLimit among its enabled admission plugins, applying rate controls to Kubernetes Event objects during admission

​

Risk

Without event rate limiting, bursts of Event writes from noisy or hostile workloads can overwhelm the API server, degrading availability. This leads to API timeouts, slow or stalled controller reconciliations, and amplifies DoS against control-plane endpoints.

​

Recommendation

Use the EventRateLimit admission plugin with conservative, workload-aware thresholds (global, per-namespace, per-user) to cap Event throughput. Apply defense in depth: monitor Event volume, alert on spikes, tame noisy emitters, and uphold least privilege to preserve API capacity.

​

Remediation

Dashboard steps

1. SSH to the control-plane node and edit the API server static pod manifest:
   • File: /etc/kubernetes/manifests/kube-apiserver.yaml
2. In the kube-apiserver container args/command list, ensure EventRateLimit is enabled:
   • If the flag exists, append EventRateLimit to the list: —enable-admission-plugins=… ,EventRateLimit
   • If missing, add it: —enable-admission-plugins=EventRateLimit
3. Save the file. The kubelet will restart the API server automatically and the check will pass.

​

References

• https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#eventratelimit

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_event_rate_limit. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks