The admission control plugin EventRateLimit is not set misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_78
Category - Subcategory	Kubernetes - Native Security Controls
Provider	OTHER
Severity	MEDIUM
Framework	Helm, Kubernetes, Kustomize

Impact

Limit the rate at which the API server accepts requests. Using EventRateLimit admission control enforces a limit on the number of events that the API Server will accept in a given time slice.

A misbehaving workload could overwhelm and DoS the API Server, making it unavailable. This particularly applies to a multi-tenant cluster, where there might be a small percentage of misbehaving tenants which could have a significant impact on the performance of the cluster overall.

Hence, it is recommended to limit the rate of events that the API server will accept.

NOTE: This is an Alpha feature in the Kubernetes 1.15 release.

How to Fix

Kind: Pod [source,go]

apiVersion: apiserver.config.k8s.io/v1 kind: AdmissionConfiguration metadata: name: "admission-configuration-passed" plugins:

• name: ValidatingAdmissionWebhook configuration: apiVersion: apiserver.config.k8s.io/v1 kind: WebhookAdmissionConfiguration kubeConfigFile: ""
• • name: EventRateLimit
• path: eventconfig.yaml
• name: MutatingAdmissionWebhook configuration: apiVersion: apiserver.config.k8s.io/v1 kind: WebhookAdmissionConfiguration kubeConfigFile: ""

---