aws / aws/eks-anywhere

vSphere Bottlerocket EKSA unable to pass CIS Benchmark at 4.2.13 - Ensure that a limit is set on pod PIDs

Open
#7,638 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2.1k
Forks
328
Avg merge
1d 4h
Merged PRs (30d)
9

Description

**What happened**:

We are currently seeing the default settings result in clusters allowing 4M pids. According to kubernetes documentation, this is a setting you pass to kubelet.

https://kubernetes.io/docs/concepts/policy/pid-limiting/#pod-pid-limits

**What you expected to happen**:

However those tunables aren't available to EKSA Configs:
https://anywhere.eks.amazonaws.com/docs/getting-started/vsphere/vsphere-spec/

We anticipate it would be located under kubernetes options here:
https://anywhere.eks.amazonaws.com/docs/getting-started/optional/hostosconfig/#kubernetes

However, it is not listed.

**How to reproduce it (as minimally and precisely as possible)**:
See Above

**Anything else we need to know?**:
Case ID 170619344001280

Contributor guide

Open the contributing guide

Research direction

Start with the vSphere specification and the HostOSConfig Kubernetes options linked in the issue, then compare them with Kubernetes' pod PID limit documentation. Trace how the relevant kubelet tunables are represented in EKS Anywhere configuration; done means users can configure a pod PID limit and satisfy CIS benchmark 4.2.13.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.