Check ID: controllermanager_garbage_collection
Provider: Kubernetes
Service: controllermanager
Severity: HIGH
Categories: cluster-security
Resource type: Pod

​
What this check verifies

Kubernetes controller manager terminated Pod garbage collection threshold is evaluated. The finding highlights use of the default --terminated-pod-gc-threshold=12500 instead of a value tuned to cluster size and workload churn. The threshold controls when terminated Pods are automatically removed.

​
Risk

Retaining too many terminated Pods strains API server, etcd, and controller memory, reducing control-plane availability. Effects include slow list/watch operations, lagging schedulers, timeouts, and, in worst cases, controller crashes or admin-plane DoS.

​
Recommendation

Set a lower, context-appropriate --terminated-pod-gc-threshold to match cluster scale and pod churn, preserving control-plane capacity. Monitor garbage collection and control-plane metrics and adjust proactively. Use ttlSecondsAfterFinished for Jobs to minimize terminated Pods.

​
Remediation

Dashboard steps
  1. SSH to each control-plane node
  2. Edit the static Pod manifest: /etc/kubernetes/manifests/kube-controller-manager.yaml
  3. Under the kube-controller-manager container args/command, set: —terminated-pod-gc-threshold=10 (any value not equal to 12500)
  4. Save the file; the kubelet will automatically restart the controller-manager
  5. Repeat on all control-plane nodes if using HA

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = controllermanager_garbage_collection. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks