Kubelet streaming connection idle timeout is not set to 0

​

What this check verifies

Kubernetes Kubelet streaming sessions use a non-zero idle timeout via streamingConnectionIdleTimeout for exec, logs, and port-forward connections. Assesses whether this setting exists and is not 0.

​

Risk

With 0 (no timeout), idle exec/logs/port-forward streams can persist, consuming sockets, file descriptors, and memory. This enables resource exhaustion and DoS, degrading node availability and potentially disrupting workload operations and administrative access.

​

Recommendation

Set a bounded, non-zero streamingConnectionIdleTimeout aligned to operational needs; avoid 0. Apply consistently across nodes, prefer fail-safe defaults, and monitor for unusually long streaming sessions. This supports defense in depth and preserves node availability.

​

Remediation

Dashboard steps

1. SSH to each Kubernetes node.
2. If kubelet uses a config file, set a non-zero timeout:
   • Find the path: systemctl cat kubelet | grep -- --config=
   • Edit that file and add/update:
     streamingConnectionIdleTimeout: "5m"
     
3. If no config file is used, add the flag to the kubelet service drop-in (e.g., /etc/systemd/system/kubelet.service.d/10-kubeadm.conf) so the kubelet starts with:
   --streaming-connection-idle-timeout=5m
   
4. Apply the change: sudo systemctl daemon-reload && sudo systemctl restart kubelet

​

References

• https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_streaming_connection_timeout. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks