API server pod has --request-timeout configured

​

What this check verifies

Kubernetes API server has a global request timeout configured via --request-timeout. The presence of that flag on API server containers is assessed.

​

Risk

Without a defined, appropriate timeout, requests can linger and tie up handlers, reducing availability. Attackers can perform slowloris-style holds or heavy reads to cause resource exhaustion and backlog growth. Overly short timeouts can cut valid calls, disrupting controllers and clients.

​

Recommendation

Set --request-timeout to a bounded value aligned to typical non-watch calls; when needed, tune --min-request-timeout for watches. Combine with priority and fairness, rate limiting, and load testing to prevent starvation. Monitor latency and errors to adjust. Apply defense in depth.

​

Remediation

Dashboard steps

1. SSH to each control-plane node
2. Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3. In the kube-apiserver container’s command list, add:
   - --request-timeout=300s
   
4. Save the file; the kubelet will automatically restart the API server
5. Repeat on all control-plane nodes

​

References

• https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/#options

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_request_timeout_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks