2.1.11 Ensure that the --event-qps argument is set to 0

Information

Do not limit event creation.

Rationale:

It is important to capture all events and not restrict event creation. Events are an important source of security information and analytics that ensure that your environment is consistently monitored using the event data.

Solution

Edit the kubelet service file '/etc/systemd/system/kubelet.service.d/10-kubeadm.conf' on each worker node and set the below parameter in 'KUBELET_SYSTEM_PODS_ARGS' variable.

--event-qps=0

Based on your system, restart the 'kubelet' service. For example:

systemctl daemon-reload
systemctl restart kubelet.service

Impact:

You might need to scale up your event storage and processing capabilitles.

See Also

https://workbench.cisecurity.org/files/1788

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CSCv6|6

Plugin: Unix

Control ID: 8209a9a12c2a98ea3f7594442f768e35c6014d76b5f7409fa062e8c1b77cdcad