Back to Checks
kubernetes

API server pod has --request-timeout configured

apiserver_request_timeout_set
Service: apiserverSeverity: medium
OfficialBuilt-inVerified
Categories:cluster-securityresilience
Resource Type:Pod

Kubernetes API server has a global request timeout configured via --request-timeout.

The presence of that flag on API server containers is assessed.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without a defined, appropriate timeout, requests can linger and tie up handlers, reducing availability. Attackers can perform slowloris-style holds or heavy reads to cause resource exhaustion and backlog growth. Overly short timeouts can cut valid calls, disrupting controllers and clients.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_request_timeout_set

Recommendation

Set --request-timeout to a bounded value aligned to typical non-watch calls; when needed, tune --min-request-timeout for watches. Combine with priority and fairness, rate limiting, and load testing to prevent starvation. Monitor latency and errors to adjust. Apply defense in depth.

Remediation

Other

1SSH to each control-plane node
2Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3In the kube-apiserver container's command list, add:
4```yaml
5- --request-timeout=300s
6```
7Save the file; the kubelet will automatically restart the API server
8Repeat on all control-plane nodes

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_request_timeout_set(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Request timeout is set appropriately in pod {pod.name}."
            )
            for container in pod.containers.values():
                # Check if "--request-timeout" is set to an appropriate value
                if "--request-timeout" not in str(container.command):
                    # Assuming the value is valid, e.g., '300s' or '1m'
                    report.status = "FAIL"
                    report.status_extended = f"Request timeout is not set or not set appropriately in pod {pod.name}."
                    break

            findings.append(report)
        return findings

References