Ensure that garbage collection is configured as appropriate (Kubelet) (Openshift)

Risk Level: Low
Cloud Entity: Node
CloudGuard Rule ID: D9.K8S.OPE.09
Covered by Spectral: No
Category: Compute

GSL LOGIC

KubernetesNode should have kubeletData.kubeletconfig.evictionHard and kubeletData.kubeletconfig.evictionPressureTransitionPeriod

REMEDIATION

To configure, follow the directions in Configuring garbage collection for containers and images

References

1. https://docs.openshift.com/container-platform/4.5/operators/operator-reference.html#cluster-openshift-controller-manager-operator_red-hat-operators
2. https://docs.openshift.com/container-platform/4.5/operators/operator-reference.html#kube-controller-manager-operator_red-hat-operators
3. https://docs.openshift.com/container-platform/4.5/nodes/nodes/nodes-nodes-garbage-collection.html
4. https://github.com/openshift/kubernetes-kubelet/blob/origin-4.5-kubernetes-1.18.3/config/v1beta1/types.go#L554-L604
5. https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/
6. https://github.com/kubernetes/kubernetes/issues/28484

Node

A node is a worker machine in Kubernetes, previously known as a minion. A node may be a VM or physical machine, depending on the cluster. Each node contains the services necessary to run pods and is managed by the master components. The services on a node include the container runtime, kubelet and kube-proxy.

Compliance Frameworks

• CIS OpenShift Container Platform v4 Benchmark v1.1.0
• CIS OpenShift Container Platform v4 Benchmark v1.4.0
• OpenShift Container Platform v3