Kubelet Event QPS Argument Set For Appropriate Event Capture

More Info:

The kubelet --event-qps argument should be set to a level that ensures appropriate event capture. Proper event capture supports auditing and troubleshooting of node activity.

Risk Level

Medium

Address

Security

Compliance Standards

CIS OKE

Triage and Remediation

Remediation

Remediation

Manual Steps

On every worker node, open the kubelet systemd drop-in configuration for editing:
```
sudo vi /etc/systemd/system/kubelet.service.d/00-default.conf
```
In the ExecStart= line, add or adjust the --event-qps flag so it is explicitly set to 0 (or your chosen value that ensures appropriate capture). For example:
```
ExecStart=/usr/bin/kubelet \
  --event-qps=0 \
  ...
```
Ensure there is only one --event-qps flag present.
If your kubelet also uses a config file at /etc/kubernetes/kubelet-config.json, ensure it does not conflict. Either remove any eventQPS entry or set it consistently:
```
sudo vi /etc/kubernetes/kubelet-config.json
```
Example JSON snippet:
```
{
  "eventQPS": 0
}
```
Reload systemd configuration on the worker node:
```
sudo systemctl daemon-reload
```
Restart kubelet on the worker node (note: this briefly disrupts the node’s workloads):
```
sudo systemctl restart kubelet.service
sudo systemctl status kubelet -l
```
Verify on the worker node that kubelet is running with the desired --event-qps setting:
```
/bin/ps -fC kubelet
```
Confirm the output includes --event-qps=0 (or your chosen value).

Using kubectl

kubectl cannot modify kubelet process flags or the /etc/kubernetes/kubelet-config.json and systemd unit files on worker nodes. To remediate this finding, you must change the kubelet configuration on each worker node’s host OS (for example, /etc/systemd/system/kubelet.service.d/00-default.conf and the kubelet config file) as described in the Manual Steps section.

Automation

#!/usr/bin/env bash
# Remediate CIS OKE 3.2.7: ensure kubelet --event-qps=0 (every worker node)
# Run on each worker node as root.

set -euo pipefail

KUBELET_DROPIN_DIR="/etc/systemd/system/kubelet.service.d"
KUBELET_DROPIN_FILE="${KUBELET_DROPIN_DIR}/00-default.conf"
TARGET_FLAG="--event-qps=0"

echo "[INFO] Ensuring kubelet drop-in directory exists: ${KUBELET_DROPIN_DIR}"
mkdir -p "${KUBELET_DROPIN_DIR}"

echo "[INFO] Ensuring ${KUBELET_DROPIN_FILE} exists"
touch "${KUBELET_DROPIN_FILE}"

echo "[INFO] Updating/adding ${TARGET_FLAG} in kubelet systemd drop-in"

# Ensure an Environment= line that contains KUBELET_KUBEADM_ARGS exists,
# then ensure it contains the desired flag and no conflicting --event-qps.
if grep -q 'Environment=.*KUBELET_KUBEADM_ARGS' "${KUBELET_DROPIN_FILE}"; then
  # Remove any existing --event-qps=... from that line, then append the correct flag if missing.
  sed -i \
    -e '/Environment=.*KUBELET_KUBEADM_ARGS/{
      s/--event-qps=[^" ]*//g
    }' \
    "${KUBELET_DROPIN_FILE}"

  if ! grep -q 'Environment=.*KUBELET_KUBEADM_ARGS.*--event-qps=0' "${KUBELET_DROPIN_FILE}"; then
    sed -i \
      -e '/Environment=.*KUBELET_KUBEADM_ARGS/{
        s/"$/ '"${TARGET_FLAG}"'"/
      }' \
      "${KUBELET_DROPIN_FILE}"
  fi
else
  # No KUBELET_KUBEADM_ARGS line yet; append one with the desired flag.
  cat <<EOF >> "${KUBELET_DROPIN_FILE}"
[Service]
Environment="KUBELET_KUBEADM_ARGS=${TARGET_FLAG}"
EOF
fi

echo "[INFO] Reloading systemd and restarting kubelet"
systemctl daemon-reload
systemctl restart kubelet.service

echo "[INFO] Checking kubelet status"
systemctl status kubelet.service -l --no-pager || true

echo "[INFO] Verifying kubelet process flags contain ${TARGET_FLAG} and no conflicting --event-qps"
ps_output="$(/bin/ps -fC kubelet || true)"

echo "${ps_output}"

if ! grep -q -- "${TARGET_FLAG}" <<< "${ps_output}"; then
  echo "[ERROR] kubelet is not running with ${TARGET_FLAG}." >&2
  exit 1
fi

if grep -q -- "--event-qps=" <<< "${ps_output}" && ! grep -q -- "--event-qps=0" <<< "${ps_output}"; then
  echo "[ERROR] kubelet is running with a conflicting --event-qps value." >&2
  exit 1
fi

echo "[INFO] Verification succeeded: kubelet is running with ${TARGET_FLAG}"

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​