1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate

Information

Activate garbage collector on pod termination, as appropriate.

Rationale:

Garbage collection is important to ensure sufficient resource availability and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. The current setting for garbage collection is 12,500 terminated pods which might be too high for your system to sustain. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection.

Solution

Edit the Controller Manager pod specification file '/etc/kubernetes/manifests/kube-controller-manager.yaml' on the master node and set the '--terminated-pod-gc-threshold' to an appropriate threshold, for example:

--terminated-pod-gc-threshold=10

Impact:

None

See Also

https://workbench.cisecurity.org/files/2125

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CSCv6|14

Plugin: Unix

Control ID: 92b6f90e78e3e04168654bab95b8a26caa3e04d0301ae3f3bef60dfde51c2b8f