Back to Checks
kubernetes

Kubelet eventRecordQPS is set to a positive value

kubelet_event_record_qps
Service: kubeletSeverity: high
OfficialBuilt-inVerified
Categories:resiliencecluster-security
Resource Type:ConfigMap

Kubernetes Kubelet configuration defines event rate limiting via eventRecordQPS. The setting is evaluated for presence and a positive value, where 0 means unlimited event generation.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Uncapped or mis-tuned event rates can overwhelm the API and etcd, reducing availability, or suppress key signals, harming the integrity of telemetry. Noisy pods or abuse can flood events; too-low caps drop diagnostics, hindering detection and response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_event_record_qps

Recommendation

Set eventRecordQPS to a positive, workload-appropriate rate and avoid 0. Monitor event volumes and backpressure and tune periodically. Apply defense in depth by limiting noisy workloads and enforcing operational safeguards to prevent event storms.

Remediation

Other

1SSH to each node running kubelet
2Edit /var/lib/kubelet/config.yaml and set: eventRecordQPS: 5 (any integer > 0)
3Restart kubelet: sudo systemctl restart kubelet

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.kubelet.kubelet_client import kubelet_client


class kubelet_event_record_qps(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for cm in kubelet_client.kubelet_config_maps:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=cm)
            if "eventRecordQPS" not in cm.kubelet_args:
                report.status = "MANUAL"
                report.status_extended = f"Kubelet does not have the argument `eventRecordQPS` in config file {cm.name}, verify it in the node's arguments."
            else:
                if cm.kubelet_args.get("streamingConnectionIdleTimeout") > 0:
                    report.status = "PASS"
                    report.status_extended = f"Kubelet has an appropriate eventRecordQPS setting in config file {cm.name}."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Kubelet has eventRecordQPS set to 0 that may lead to DoS conditions in config file {cm.name}."
            findings.append(report)
        return findings

References