Streaming Connection Idle Timeout Argument Is Not Set 0

More Info:

Do not disable timeouts on streaming connections.

Risk Level

Medium

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CIS EKS
CMMC 2.0
CSA Cloud Controls Matrix v4
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Manual Steps

On every worker node, check if kubelet is using a config file and whether streaming-connection-idle-timeout is passed as a flag:
```
ps -fC kubelet
```
Review the command line for --config= and for --streaming-connection-idle-timeout=.
If kubelet uses a config file (common on EKS) and /var/lib/kubelet/config.yaml exists, edit it and set a non-zero timeout (or ensure it is not 0):
```
sudo vi /var/lib/kubelet/config.yaml
```
Under the top-level keys, add or modify:
```
streamingConnectionIdleTimeout: 4h0m0s
```
Save the file.
Ensure the systemd drop-in does NOT override this with a flag set to 0. On every worker node:
```
sudo grep -i streaming-connection-idle-timeout /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf
```
If you see a line like --streaming-connection-idle-timeout=0 or any value, edit the file to remove that argument entirely:
```
sudo vi /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf
```
Remove only the --streaming-connection-idle-timeout=... part from the KUBELET_ARGS line, then save.
If instead your setup does not use a kubelet config file and only uses executable arguments, add a safe non-zero timeout in the systemd drop-in on every worker node:
```
sudo vi /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf
```
In the line defining KUBELET_ARGS=..., ensure it includes:
```
--streaming-connection-idle-timeout=4h0m0s
```
Save the file.

Reload systemd and restart kubelet on every worker node:

sudo systemctl daemon-reload
sudo systemctl restart kubelet.service
sudo systemctl status kubelet -l

Verify kubelet is now running with an appropriate timeout on every worker node:
```
/bin/ps -fC kubelet
```
Confirm either:
- The command line does not contain --streaming-connection-idle-timeout=0, and if present, it is non-zero (e.g. 4h0m0s), and/or
- If using the config file, the process includes --config=/var/lib/kubelet/config.yaml and the file contains streamingConnectionIdleTimeout: 4h0m0s.

Using kubectl

kubectl cannot change the --streaming-connection-idle-timeout setting or edit /var/lib/kubelet/config.yaml because this configuration is applied on each worker node’s host OS via kubelet flags and config files. Make the change directly on every worker node as described in the Manual Steps section.

Automation

#!/usr/bin/env bash
#
# Remediate CISEKS 3.2.5: Ensure Streaming Connection Idle Timeout Argument Is Not Set 0
#
# Usage:
#   1. Run on every worker node as root (or with sudo):
#        sudo /path/to/this-script.sh
#   2. This script is idempotent and can be safely re-run.
#
# Notes:
#   - Operates on kubelet config file (/var/lib/kubelet/config.yaml) and
#     systemd drop-in (/etc/systemd/system/kubelet.service.d/10-kubelet-args.conf).
#   - Changing kubelet configuration and systemd unit will restart kubelet.

set -euo pipefail

STREAM_TIMEOUT_VALUE="4h0m0s"

echo "[INFO] Starting remediation for kubelet streaming connection idle timeout"

#############################
# FUNCTIONS
#############################

ensure_kubelet_config_timeout() {
  local cfg="/var/lib/kubelet/config.yaml"

  if [ ! -f "$cfg" ]; then
    echo "[WARN] $cfg not found; skipping kubelet config remediation on this node"
    return 0
  fi

  echo "[INFO] Ensuring streamingConnectionIdleTimeout is set to non-zero in $cfg"

  # If key exists, replace value; otherwise, append under top-level (YAML-agnostic line edits).
  if grep -qE '^[[:space:]]*streamingConnectionIdleTimeout:' "$cfg"; then
    # Replace any existing value (including 0, empty, etc.)
    sed -i -E "s|^([[:space:]]*streamingConnectionIdleTimeout:).*|\1 ${STREAM_TIMEOUT_VALUE}|" "$cfg"
  else
    # Append to end of file as a top-level key. This is safe if config.yaml is already valid.
    printf "\nstreamingConnectionIdleTimeout: %s\n" "$STREAM_TIMEOUT_VALUE" >> "$cfg"
  fi
}

ensure_systemd_args_no_override() {
  local dropin="/etc/systemd/system/kubelet.service.d/10-kubelet-args.conf"

  if [ ! -f "$dropin" ]; then
    echo "[WARN] $dropin not found; skipping systemd args remediation on this node"
    return 0
  fi

  echo "[INFO] Ensuring --streaming-connection-idle-timeout is not specified in $dropin"

  # Remove any occurrence of the flag from the file.
  # 1) Remove standalone lines containing the flag.
  sed -i -E '/--streaming-connection-idle-timeout[= ]/d' "$dropin"

  # 2) Remove inline occurrences from KUBELET_ARGS or ExecStart lines.
  #    Handle cases with space-separated flags.
  sed -i -E 's/ --streaming-connection-idle-timeout(=[^ ]*)?//g' "$dropin"
  sed -i -E 's/--streaming-connection-idle-timeout(=[^ ]*)? //g' "$dropin"
}

restart_kubelet() {
  echo "[INFO] Restarting kubelet (this will briefly disrupt workloads on this node)"
  systemctl daemon-reload
  systemctl restart kubelet.service
  systemctl status kubelet -l --no-pager || true
}

verify() {
  echo "[INFO] Verifying kubelet process arguments"
  /bin/ps -fC kubelet || {
    echo "[ERROR] kubelet process not found after remediation"
    return 1
  }

  if /bin/ps -fC kubelet | grep -q -- '--streaming-connection-idle-timeout=0'; then
    echo "[ERROR] kubelet still has --streaming-connection-idle-timeout=0 in arguments"
    return 1
  fi

  if /bin/ps -fC kubelet | grep -q -- '--streaming-connection-idle-timeout='; then
    echo "[WARN] kubelet uses CLI flag --streaming-connection-idle-timeout (non-zero assumed)."
    echo "[WARN] Ensure it is set to ${STREAM_TIMEOUT_VALUE} or another non-zero value."
  else
    echo "[INFO] kubelet does not use CLI --streaming-connection-idle-timeout flag (config file should apply)"
  fi

  local cfg="/var/lib/kubelet/config.yaml"
  if [ -f "$cfg" ]; then
    echo "[INFO] Checking $cfg for streamingConnectionIdleTimeout"
    grep -E '^[[:space:]]*streamingConnectionIdleTimeout:' "$cfg" || {
      echo "[WARN] streamingConnectionIdleTimeout not found in $cfg; kubelet may be using defaults or other config mechanism"
    }
  fi

  echo "[INFO] Verification complete"
}

#############################
# MAIN
#############################

ensure_kubelet_config_timeout
ensure_systemd_args_no_override
restart_kubelet
verify

Additional Reading:

https://github.com/kubernetes/kubernetes/pull/18552

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

Additional Reading:​