Back to Checks
kubernetes

Kubelet streaming connection idle timeout is not set to 0

kubelet_streaming_connection_timeout
Service: kubeletSeverity: medium
OfficialBuilt-inVerified
Categories:node-security
Resource Type:ConfigMap

Kubernetes Kubelet streaming sessions use a non-zero idle timeout via streamingConnectionIdleTimeout for exec, logs, and port-forward connections.

Assesses whether this setting exists and is not 0.

Prowler logoProwlerprowler-provider-kubernetes

Risk

With 0 (no timeout), idle exec/logs/port-forward streams can persist, consuming sockets, file descriptors, and memory. This enables resource exhaustion and DoS, degrading node availability and potentially disrupting workload operations and administrative access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_streaming_connection_timeout

Recommendation

Set a bounded, non-zero streamingConnectionIdleTimeout aligned to operational needs; avoid 0.

Apply consistently across nodes, prefer fail-safe defaults, and monitor for unusually long streaming sessions. This supports defense in depth and preserves node availability.

Remediation

Other

1SSH to each Kubernetes node.
2If kubelet uses a config file, set a non-zero timeout:
3- Find the path: `systemctl cat kubelet | grep -- --config=`
4- Edit that file and add/update:
5```yaml
6streamingConnectionIdleTimeout: "5m"
7```
8If no config file is used, add the flag to the kubelet service drop-in (e.g., `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf`) so the kubelet starts with:
9```
10--streaming-connection-idle-timeout=5m
11```
12Apply the change: `sudo systemctl daemon-reload && sudo systemctl restart kubelet`

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.kubelet.kubelet_client import kubelet_client


class kubelet_streaming_connection_timeout(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for cm in kubelet_client.kubelet_config_maps:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=cm)
            if "streamingConnectionIdleTimeout" not in cm.kubelet_args:
                report.status = "MANUAL"
                report.status_extended = f"Kubelet does not have the argument `streamingConnectionIdleTimeout` in config file {cm.name}, verify it in the node's arguments."
            else:
                if cm.kubelet_args["streamingConnectionIdleTimeout"] != 0:
                    report.status = "PASS"
                    report.status_extended = f"Kubelet is configured with a non-zero streaming connection idle timeout in config file {cm.name}."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Kubelet has a streaming connection idle timeout set to 0 in config file {cm.name}."
            findings.append(report)
        return findings

References