> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API Server Should Enable The EventRateLimit Admission Plugin

### More Info:

Verifies that the EventRateLimit admission plugin is enabled to limit the rate of API requests and protect the API server from denial-of-service.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Create the EventRateLimit configuration file (every control plane node)**
           ```bash theme={null}
           sudo mkdir -p /etc/kubernetes/admission
           sudo tee /etc/kubernetes/admission/event-rate-limit.yaml >/dev/null << 'EOF'
           apiVersion: apiserver.k8s.io/v1alpha1
           kind: AdmissionConfiguration
           plugins:
           - name: EventRateLimit
             path: /etc/kubernetes/admission/event-rate-limit-config.yaml
           EOF

           sudo tee /etc/kubernetes/admission/event-rate-limit-config.yaml >/dev/null << 'EOF'
           apiVersion: eventratelimit.admission.k8s.io/v1alpha1
           kind: Configuration
           limits:
           - type: Namespace
             qps: 50
             burst: 100
           - type: User
             qps: 10
             burst: 20
           EOF
           ```

        2. **Back up the existing API server static pod manifest (every control plane node)**
           ```bash theme={null}
           sudo cp -a /etc/kubernetes/manifests/kube-apiserver.yaml \
             /etc/kubernetes/manifests/kube-apiserver.yaml.backup.$(date +%F-%H%M%S)
           ```

        3. **Edit the API server manifest to enable EventRateLimit (every control plane node)**\
           Open the file:
           ```bash theme={null}
           sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
           ```
           In the `spec.containers[0].command` list:
           * Ensure `--enable-admission-plugins` includes `EventRateLimit` (add it to the comma‑separated list, do not remove existing plugins), for example:
             ```yaml theme={null}
             - --enable-admission-plugins=NodeRestriction,EventRateLimit
             ```
           * Add or update the admission config flag to point to the file you created:
             ```yaml theme={null}
             - --admission-control-config-file=/etc/kubernetes/admission/event-rate-limit.yaml
             ```

        4. **Ensure the admission config files are mounted into the API server pod (every control plane node)**\
           In the same manifest, under the container `volumeMounts`, add if not present:
           ```yaml theme={null}
           - mountPath: /etc/kubernetes/admission
             name: admission-config
             readOnly: true
           ```
           Under `volumes`, add if not present:
           ```yaml theme={null}
           - name: admission-config
             hostPath:
               path: /etc/kubernetes/admission
               type: DirectoryOrCreate
           ```

        5. **Allow the API server to restart and stabilize (every control plane node)**\
           Saving `/etc/kubernetes/manifests/kube-apiserver.yaml` causes the kubelet to restart the `kube-apiserver` static pod automatically. Wait and confirm the pod is running:
           ```bash theme={null}
           sudo crictl ps | grep kube-apiserver || sudo docker ps | grep kube-apiserver
           ```

        6. **Verify EventRateLimit is enabled and configured (every control plane node)**
           ```bash theme={null}
           /bin/ps -ef | grep kube-apiserver | grep -v grep \
             | grep -- '--enable-admission-plugins' \
             | grep 'EventRateLimit' && \
           /bin/ps -ef | grep kube-apiserver | grep -v grep \
             | grep -- '--admission-control-config-file=/etc/kubernetes/admission/event-rate-limit.yaml'
           ```
           Optionally, confirm the flag values inside the container:
           ```bash theme={null}
           kubectl -n kube-system get pod -l component=kube-apiserver -o wide
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot be used to enable the EventRateLimit admission plugin because this setting is defined in the API server’s static pod manifest on each control plane node at `/etc/kubernetes/manifests/kube-apiserver.yaml`. To remediate this finding, follow the guidance in the Manual Steps section and update the host-level configuration directly on the control plane nodes.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Automates enabling the EventRateLimit admission plugin on all control plane nodes.
        # - Creates an EventRateLimit config file at /etc/kubernetes/admission-control-eventratelimit.yaml
        # - Ensures kube-apiserver manifest has:
        #     --enable-admission-plugins=...,EventRateLimit,...
        #     --admission-control-config-file=/etc/kubernetes/admission-control-eventratelimit.yaml
        # - Safe to re-run.
        #
        # RUN ON: each control plane node (with root privileges)

        set -euo pipefail

        APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
        EVENT_RL_CFG="/etc/kubernetes/admission-control-eventratelimit.yaml"

        backup_file() {
          local f="$1"
          if [ -f "$f" ] && [ ! -f "${f}.pre-eventratelimit.bak" ]; then
            cp -p "$f" "${f}.pre-eventratelimit.bak"
          fi
        }

        ensure_eventratelimit_config() {
          mkdir -p "$(dirname "$EVENT_RL_CFG")"
          backup_file "$EVENT_RL_CFG" || true

          cat > "$EVENT_RL_CFG.tmp" <<'EOF'
        apiVersion: apiserver.k8s.io/v1alpha1
        kind: AdmissionConfiguration
        plugins:
        - name: EventRateLimit
          path: /etc/kubernetes/eventconfig.yaml
        ---
        apiVersion: eventratelimit.admission.k8s.io/v1alpha1
        kind: Configuration
        limits:
        - type: Namespace
          qps: 50
          burst: 100
        - type: User
          qps: 20
          burst: 50
        EOF

          # Optional: eventconfig referenced above
          cat > /etc/kubernetes/eventconfig.yaml.tmp <<'EOF'
        apiVersion: eventratelimit.admission.k8s.io/v1alpha1
        kind: Configuration
        limits:
        - type: Namespace
          qps: 50
          burst: 100
        - type: User
          qps: 20
          burst: 50
        EOF

          mv "$EVENT_RL_CFG.tmp" "$EVENT_RL_CFG"
          chmod 600 "$EVENT_RL_CFG"

          mv /etc/kubernetes/eventconfig.yaml.tmp /etc/kubernetes/eventconfig.yaml
          chmod 600 /etc/kubernetes/eventconfig.yaml
        }

        patch_apiserver_manifest() {
          if [ ! -f "$APISERVER_MANIFEST" ]; then
            echo "ERROR: $APISERVER_MANIFEST not found; this script is for static pod control planes." >&2
            exit 1
          fi

          backup_file "$APISERVER_MANIFEST"

          # 1) Ensure --enable-admission-plugins has EventRateLimit
          if grep -q -- '--enable-admission-plugins=' "$APISERVER_MANIFEST"; then
            # If EventRateLimit is missing, add it
            if ! grep -q -- '--enable-admission-plugins=.*EventRateLimit' "$APISERVER_MANIFEST"; then
              sed -i -E \
                's/(--enable-admission-plugins=)([^" ]*)/\1\2,EventRateLimit/' \
                "$APISERVER_MANIFEST"
            fi
          else
            # Add a new flag line under the kube-apiserver container args
            # This assumes a standard kubeadm manifest with "- kube-apiserver" line.
            if grep -q '^\s*- kube-apiserver' "$APISERVER_MANIFEST"; then
              sed -i \
                '/^\s*- kube-apiserver/a\    - --enable-admission-plugins=EventRateLimit' \
                "$APISERVER_MANIFEST"
            else
              echo "WARNING: Could not find '- kube-apiserver' to attach --enable-admission-plugins; please edit $APISERVER_MANIFEST manually." >&2
            fi
          fi

          # 2) Ensure --admission-control-config-file points to our config
          if grep -q -- '--admission-control-config-file=' "$APISERVER_MANIFEST"; then
            sed -i -E \
              "s#--admission-control-config-file=[^\" ]*#--admission-control-config-file=${EVENT_RL_CFG}#g" \
              "$APISERVER_MANIFEST"
          else
            if grep -q '^\s*- kube-apiserver' "$APISERVER_MANIFEST"; then
              sed -i \
                "/^\s*- kube-apiserver/a\    - --admission-control-config-file=${EVENT_RL_CFG}" \
                "$APISERVER_MANIFEST"
            else
              echo "WARNING: Could not find '- kube-apiserver' to attach --admission-control-config-file; please edit $APISERVER_MANIFEST manually." >&2
            fi
          fi

          echo "NOTE: Editing $APISERVER_MANIFEST will cause the kube-apiserver static pod to restart on this node."
        }

        verify() {
          echo "Waiting 30s for kube-apiserver static pod restart..."
          sleep 30

          echo "Verifying kube-apiserver process flags..."
          if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--enable-admission-plugins=.*EventRateLimit'; then
            echo "OK: EventRateLimit is present in --enable-admission-plugins."
          else
            echo "FAIL: EventRateLimit not found in --enable-admission-plugins." >&2
            /bin/ps -ef | grep kube-apiserver | grep -v grep || true
            exit 1
          fi

          if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--admission-control-config-file=${EVENT_RL_CFG}"; then
            echo "OK: --admission-control-config-file points to ${EVENT_RL_CFG}."
          else
            echo "FAIL: --admission-control-config-file not correctly set to ${EVENT_RL_CFG}." >&2
            /bin/ps -ef | grep kube-apiserver | grep -v grep || true
            exit 1
          fi
        }

        main() {
          ensure_eventratelimit_config
          patch_apiserver_manifest
          verify
        }

        main "$@"
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>