Ensure that garbage collection is configured as appropriate (Kubelet) (Openshift)

Activate garbage collector on pod termination, as appropriate.

Risk Level: Low
Cloud Entity: Node
CloudGuard Rule ID: D9.K8S.OPE.09
Covered by Spectral: No
Category: Compute

GSL LOGIC

KubernetesNode should have kubeletData.kubeletconfig.evictionHard and kubeletData.kubeletconfig.evictionPressureTransitionPeriod

REMEDIATION

To configure, follow the directions in Configuring garbage collection for containers and images

References

  1. https://docs.openshift.com/container-platform/4.5/operators/operator-reference.html#cluster-openshift-controller-manager-operator_red-hat-operators
  2. https://docs.openshift.com/container-platform/4.5/operators/operator-reference.html#kube-controller-manager-operator_red-hat-operators
  3. https://docs.openshift.com/container-platform/4.5/nodes/nodes/nodes-nodes-garbage-collection.html
  4. https://github.com/openshift/kubernetes-kubelet/blob/origin-4.5-kubernetes-1.18.3/config/v1beta1/types.go#L554-L604
  5. https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/
  6. https://github.com/kubernetes/kubernetes/issues/28484

Node

A node is a worker machine in Kubernetes, previously known as a minion. A node may be a VM or physical machine, depending on the cluster. Each node contains the services necessary to run pods and is managed by the master components. The services on a node include the container runtime, kubelet and kube-proxy.

Compliance Frameworks

  • CIS OpenShift Container Platform v4 Benchmark v1.1.0
  • CIS OpenShift Container Platform v4 Benchmark v1.4.0
  • OpenShift Container Platform v3