Streaming Connection Idle Timeout Argument Is Not Set 0

More Info:

Do not disable timeouts on streaming connections.

Risk Level

Medium

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS AKS
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Manual Steps

On every worker node, back up the Kubelet config file and open it for editing:

sudo cp /var/lib/kubelet/config.yaml /var/lib/kubelet/config.yaml.bak
sudo vi /var/lib/kubelet/config.yaml

In /var/lib/kubelet/config.yaml, locate the streamingConnectionIdleTimeout field (add it if missing) and set it to a non‑zero value, for example:
```
streamingConnectionIdleTimeout: 5m
```
Save and exit the editor.
If the kubelet is also configured via systemd arguments, edit the kubelet drop-in on the same worker node:
```
sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
```
In the KUBELET_SYSTEM_PODS_ARGS (or equivalent) environment variable, ensure the flag is set and not 0, for example append or modify:
```
--streaming-connection-idle-timeout=5m
```
Save and exit.
Reload systemd configuration and restart the kubelet on the worker node (this will disrupt workloads scheduled there briefly):
```
sudo systemctl daemon-reload
sudo systemctl restart kubelet.service
```
Verify the kubelet is running with a non‑zero streaming connection idle timeout on that worker node:
```
/bin/ps -fC kubelet | grep -- --streaming-connection-idle-timeout
```
Confirm the output shows --streaming-connection-idle-timeout=5m (or another non‑zero value) and not =0.

Using kubectl

kubectl cannot modify kubelet process flags or its config file on worker nodes, so this finding cannot be remediated via the Kubernetes API. The timeout must be fixed directly in /var/lib/kubelet/config.yaml (or the kubelet systemd unit) on every worker node; follow the Manual Steps section for the exact host-level changes.

Automation

#!/usr/bin/env bash
#
# Remediation: Ensure Kubelet streamingConnectionIdleTimeout is not 0
# Scope: Run on every worker node
# Idempotent: safe to re-run

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
TIMEOUT_VALUE="5m"

echo "==> Ensuring kubelet streaming connection idle timeout is not 0"

# Function: ensure key in kubelet config.yaml
ensure_config_yaml_timeout() {
  local cfg="$1"
  local key="streamingConnectionIdleTimeout"

  if [ ! -f "$cfg" ]; then
    echo "    [INFO] $cfg not found; will rely on systemd flags if present."
    return 1
  fi

  # Create backup once
  if [ ! -f "${cfg}.cis-bak" ]; then
    cp "$cfg" "${cfg}.cis-bak"
  fi

  # If key exists, update its value
  if grep -qE "^[[:space:]]*$key:" "$cfg"; then
    # If already non-zero and not "0", leave as-is
    if grep -qE "^[[:space:]]*$key:[[:space:]]*0[[:space:]]*$" "$cfg"; then
      echo "    [INFO] $key currently 0, updating to ${TIMEOUT_VALUE}"
      # Replace line with new value
      sed -i "s/^\([[:space:]]*$key:\).*/\1 ${TIMEOUT_VALUE}/" "$cfg"
    else
      echo "    [INFO] $key already set to non-zero; leaving as-is"
    fi
  else
    echo "    [INFO] $key not present; adding with value ${TIMEOUT_VALUE}"
    printf "\n%s: %s\n" "$key" "$TIMEOUT_VALUE" >> "$cfg"
  fi

  return 0
}

# Function: ensure systemd flag
ensure_systemd_flag() {
  local dropin="$1"
  local flag="--streaming-connection-idle-timeout=${TIMEOUT_VALUE}"

  if [ ! -f "$dropin" ]; then
    echo "    [INFO] $dropin not found; not modifying systemd unit."
    return 1
  fi

  if [ ! -f "${dropin}.cis-bak" ]; then
    cp "$dropin" "${dropin}.cis-bak"
  fi

  # If flag already present with a non-zero value, keep it
  if grep -q -- "--streaming-connection-idle-timeout=" "$dropin"; then
    if grep -q -- "--streaming-connection-idle-timeout=0" "$dropin"; then
      echo "    [INFO] Updating systemd flag to ${TIMEOUT_VALUE}"
      sed -i "s/--streaming-connection-idle-timeout=[^[:space:]]*/${flag}/" "$dropin"
    else
      echo "    [INFO] Systemd flag already non-zero; leaving as-is"
    fi
  else
    echo "    [INFO] Adding systemd flag ${flag}"
    # Insert into existing KUBELET_*_ARGS or into ExecStart if needed
    if grep -q "^Environment=\"KUBELET_SYSTEM_PODS_ARGS=" "$dropin"; then
      sed -i "s|^Environment=\"KUBELET_SYSTEM_PODS_ARGS=\(.*\)\"|Environment=\"KUBELET_SYSTEM_PODS_ARGS=\1 ${flag}\"|" "$dropin"
    elif grep -q "^ExecStart=" "$dropin"; then
      sed -i "s|^ExecStart=\(.*kubelet\)\(.*\)$|ExecStart=\1\2 ${flag}|" "$dropin"
    else
      # As a fallback, append an additional Environment line
      printf '\nEnvironment="KUBELET_SYSTEM_PODS_ARGS=%s"\n' "${flag}" >> "$dropin"
    fi
  fi

  return 0
}

echo "==> Updating kubelet configuration on this node"

yaml_changed=0
systemd_changed=0

if ensure_config_yaml_timeout "$KUBELET_CONFIG"; then
  yaml_changed=1
fi

if ensure_systemd_flag "$SYSTEMD_DROPIN"; then
  systemd_changed=1
fi

echo "==> Reloading and restarting kubelet (this will restart the kubelet on this worker node)"

systemctl daemon-reload
systemctl restart kubelet.service

sleep 5

echo "==> Verification: checking kubelet process flags"
ps_output="$(/bin/ps -fC kubelet || true)"
echo "$ps_output"

if echo "$ps_output" | grep -q -- "--streaming-connection-idle-timeout=0"; then
  echo "    [FAIL] kubelet still has --streaming-connection-idle-timeout=0 in flags"
  exit 1
fi

echo "==> Verification: checking kubelet config file (if present)"
if [ -f "$KUBELET_CONFIG" ]; then
  if grep -qE "^[[:space:]]*streamingConnectionIdleTimeout:[[:space:]]*0[[:space:]]*$" "$KUBELET_CONFIG"; then
    echo "    [FAIL] streamingConnectionIdleTimeout is still 0 in ${KUBELET_CONFIG}"
    exit 1
  fi
fi

echo "==> Success: streaming connection idle timeout is not set to 0 on this worker node."

Additional Reading:

https://github.com/kubernetes/kubernetes/pull/18552

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

Additional Reading:​