Kubelet eventRecordQPS is set to a positive value

​

What this check verifies

Kubernetes Kubelet configuration defines event rate limiting via eventRecordQPS. The setting is evaluated for presence and a positive value, where 0 means unlimited event generation.

​

Risk

Uncapped or mis-tuned event rates can overwhelm the API and etcd, reducing availability, or suppress key signals, harming the integrity of telemetry. Noisy pods or abuse can flood events; too-low caps drop diagnostics, hindering detection and response.

​

Recommendation

Set eventRecordQPS to a positive, workload-appropriate rate and avoid 0. Monitor event volumes and backpressure and tune periodically. Apply defense in depth by limiting noisy workloads and enforcing operational safeguards to prevent event storms.

​

Remediation

Dashboard steps

1. SSH to each node running kubelet
2. Edit /var/lib/kubelet/config.yaml and set: eventRecordQPS: 5 (any integer > 0)
3. Restart kubelet: sudo systemctl restart kubelet

​

References

• https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_event_record_qps. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks