Back to Checks
kubernetes

API server pod has the EventRateLimit admission control plugin enabled

apiserver_event_rate_limit
Service: apiserverSeverity: medium
OfficialBuilt-inVerified
Categories:cluster-securityresilience
Resource Type:Pod

Kubernetes API server includes EventRateLimit among its enabled admission plugins, applying rate controls to Kubernetes Event objects during admission

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without event rate limiting, bursts of Event writes from noisy or hostile workloads can overwhelm the API server, degrading availability. This leads to API timeouts, slow or stalled controller reconciliations, and amplifies DoS against control-plane endpoints.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_event_rate_limit

Recommendation

Use the EventRateLimit admission plugin with conservative, workload-aware thresholds (global, per-namespace, per-user) to cap Event throughput.

Apply defense in depth: monitor Event volume, alert on spikes, tame noisy emitters, and uphold least privilege to preserve API capacity.

Remediation

Other

1SSH to the control-plane node and edit the API server static pod manifest:
2- File: /etc/kubernetes/manifests/kube-apiserver.yaml
3In the kube-apiserver container args/command list, ensure EventRateLimit is enabled:
4- If the flag exists, append EventRateLimit to the list:
5--enable-admission-plugins=... ,EventRateLimit
6- If missing, add it:
7--enable-admission-plugins=EventRateLimit
8Save the file. The kubelet will restart the API server automatically and the check will pass.

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_event_rate_limit(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"EventRateLimit admission control plugin is set in pod {pod.name}."
            )
            plugin_set = False
            for container in pod.containers.values():
                plugin_set = False
                for command in container.command:
                    if command.startswith("--enable-admission-plugins"):
                        if "EventRateLimit" not in (command.split("=")[1]):
                            plugin_set = True
                            break
                if not plugin_set:
                    break
            if not plugin_set:
                report.status = "FAIL"
                report.status_extended = f"EventRateLimit admission control plugin is not set in pod {pod.name}."

            findings.append(report)
        return findings

References