Skip to main content

Event Record Qps Argument Is Set 0 Level Which Ensures

More Info:​

Security relevant information should be captured. The eventRecordQPS on the Kubelet configuration can be used to limit the rate at which events are gathered and sets the maximum event creations per second. Setting this too low could result in relevant events not being logged, however the unlimited setting of 0 could result in a denial of service on the kubelet.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AKS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check how kubelet is configured:

    ps -fC kubelet

    Review the command line for --config (config file) and any --event-qps flag. This will tell you whether you are using /var/lib/kubelet/config.yaml and/or systemd flags.

  2. If using the kubelet config file, back it up and edit the eventRecordQPS field on every worker node:

    cp /var/lib/kubelet/config.yaml /var/lib/kubelet/config.yaml.bak
    vi /var/lib/kubelet/config.yaml

    In the file, ensure there is a line like the following under the top-level configuration (adjust the numeric value to your policy; avoid 0 unless you explicitly accept unlimited events):

    eventRecordQPS: 50

    Save the file.

  3. If using command-line arguments instead of (or in addition to) the config file, edit the systemd drop‑in on every worker node:

    cp /etc/systemd/system/kubelet.service.d/10-kubeadm.conf /etc/systemd/system/kubelet.service.d/10-kubeadm.conf.bak
    vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

    In the Environment= line(s), either add or adjust the --event-qps flag to an appropriate non‑zero value that your organization deems sufficient, for example:

    Environment="KUBELET_KUBEADM_ARGS=... --event-qps=50 ..."

    Make sure there is only one --event-qps setting.

  4. Reload systemd configuration and restart kubelet on every worker node to apply changes:

    systemctl daemon-reload
    systemctl restart kubelet.service

  5. Confirm kubelet is using the intended configuration on every worker node:

    ps -fC kubelet

    If you set the value via config file, confirm the --config=/var/lib/kubelet/config.yaml flag is present and then inspect the file:

    grep -n 'eventRecordQPS' /var/lib/kubelet/config.yaml

    If you set it via command line, verify the ps output shows the expected --event-qps=<your_value> and that it is not set to 0 unless you have explicitly accepted unlimited event recording.

Using kubectl

kubectl cannot modify kubelet process flags or its config file on worker nodes, so this finding cannot be remediated via the Kubernetes API. To adjust eventRecordQPS/--event-qps, make the change directly in /var/lib/kubelet/config.yaml or the kubelet systemd unit on each worker node as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
# Automation: Configure kubelet eventRecordQPS on every worker node
# Usage: run as root on each worker node (or via SSH/Ansible), optionally:
#   EVENT_QPS=50 ./fix-kubelet-event-qps.sh

set -euo pipefail

EVENT_QPS="${EVENT_QPS:-50}"   # Choose an appropriate non-zero level for your environment

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"

echo "Configuring kubelet eventRecordQPS=${EVENT_QPS}"

if [ ! -f "${KUBELET_CONFIG}" ]; then
  echo "ERROR: ${KUBELET_CONFIG} not found on this node. Nothing changed."
  exit 1
fi

# Ensure yq is present (for reliable YAML editing)
if ! command -v yq >/dev/null 2>&1; then
  echo "ERROR: yq is required but not installed. Install yq v4+ and re-run."
  exit 1
fi

# Backup kubelet config once
BACKUP="${KUBELET_CONFIG}.$(date +%Y%m%d%H%M%S).bak"
cp -n "${KUBELET_CONFIG}" "${BACKUP}" || true

# Idempotently set eventRecordQPS in kubelet config file
TMP_FILE="$(mktemp)"
yq e ".eventRecordQPS = ${EVENT_QPS}" "${KUBELET_CONFIG}" > "${TMP_FILE}"
chmod --reference="${KUBELET_CONFIG}" "${TMP_FILE}"
mv "${TMP_FILE}" "${KUBELET_CONFIG}"

echo "Updated ${KUBELET_CONFIG} with eventRecordQPS=${EVENT_QPS}"

# If kubelet is using command-line args via systemd drop-in, ensure no conflicting --event-qps
if [ -f "${SYSTEMD_DROPIN}" ]; then
  if grep -q -- "--event-qps" "${SYSTEMD_DROPIN}"; then
    BACKUP_SYS="${SYSTEMD_DROPIN}.$(date +%Y%m%d%H%M%S).bak"
    cp -n "${SYSTEMD_DROPIN}" "${BACKUP_SYS}" || true
    sed -i 's/--event-qps=[^[:space:]]*//g' "${SYSTEMD_DROPIN}"
    echo "Removed --event-qps from ${SYSTEMD_DROPIN} to avoid conflicts with config.yaml"
  fi
fi

# Reload and restart kubelet (this will restart the kubelet and any static pods it manages)
echo "Restarting kubelet..."
systemctl daemon-reload
systemctl restart kubelet.service

# Verification: confirm kubelet is running and eventRecordQPS is effective
sleep 5

echo "Verifying kubelet process and configuration..."
/bin/ps -fC kubelet || {
  echo "ERROR: kubelet is not running after restart."
  exit 1
}

# Verify from config file
CONFIG_VALUE="$(yq e '.eventRecordQPS' "${KUBELET_CONFIG}" || echo "")"
if [ "${CONFIG_VALUE}" != "${EVENT_QPS}" ]; then
  echo "ERROR: eventRecordQPS in ${KUBELET_CONFIG} is '${CONFIG_VALUE}', expected '${EVENT_QPS}'."
  exit 1
fi

echo "Kubelet eventRecordQPS successfully set to ${EVENT_QPS} on this worker node."

Additional Reading:​