vSphere Bottlerocket EKSA unable to pass CIS Benchmark at 4.2.13 - Ensure that a limit is set on pod PIDs
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 328
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 9
Description
**What happened**:
We are currently seeing the default settings result in clusters allowing 4M pids. According to kubernetes documentation, this is a setting you pass to kubelet.
https://kubernetes.io/docs/concepts/policy/pid-limiting/#pod-pid-limits
**What you expected to happen**:
However those tunables aren't available to EKSA Configs:
https://anywhere.eks.amazonaws.com/docs/getting-started/vsphere/vsphere-spec/
We anticipate it would be located under kubernetes options here:
https://anywhere.eks.amazonaws.com/docs/getting-started/optional/hostosconfig/#kubernetes
However, it is not listed.
**How to reproduce it (as minimally and precisely as possible)**:
See Above
**Anything else we need to know?**:
Case ID 170619344001280
Contributor guide
Research direction
Start with the vSphere specification and the HostOSConfig Kubernetes options linked in the issue, then compare them with Kubernetes' pod PID limit documentation. Trace how the relevant kubelet tunables are represented in EKS Anywhere configuration; done means users can configure a pod PID limit and satisfy CIS benchmark 4.2.13.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100