> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet Event Record QPS Set For Appropriate Event Capture

### More Info:

The kubelet eventRecordQPS should be set to a level that ensures appropriate event capture for monitoring without dropping important events.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS AKS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, open the kubelet config file and set `eventRecordQPS` to an appropriate value (example: 5):
           ```bash theme={null}
           sudo sed -i 's/^[[:space:]]*eventRecordQPS:.*$/eventRecordQPS: 5/' /var/lib/kubelet/config.yaml || \
           echo "eventRecordQPS: 5" | sudo tee -a /var/lib/kubelet/config.yaml
           ```

        2. On every worker node, ensure no conflicting `--eventRecordQPS` flag is present in the kubelet systemd drop-in; remove or adjust any such flag:
           ```bash theme={null}
           sudo sed -i 's/--eventRecordQPS=[0-9]\+//g' /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```
           Then, if you need to set it via args instead of config file, append it explicitly:
           ```bash theme={null}
           sudo sed -i 's#^\(KUBELET_KUBECONFIG_ARGS=.*\)$#\1 --eventRecordQPS=5#' /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```

        3. On every worker node, reload systemd and restart kubelet to apply the changes:
           ```bash theme={null}
           sudo systemctl daemon-reload
           sudo systemctl restart kubelet.service
           ```

        4. On every worker node, confirm kubelet is healthy after restart:
           ```bash theme={null}
           sudo systemctl status kubelet -l
           ```

        5. On every worker node, verify the running kubelet process reflects the desired `eventRecordQPS` setting:
           ```bash theme={null}
           /bin/ps -fC kubelet
           ```
           Check the command output for `--eventRecordQPS=5` if using flags, or rely on the config file if the flag is absent and `eventRecordQPS: 5` is present in `/var/lib/kubelet/config.yaml`.
      </Accordion>

      <Accordion title="Using kubectl">
        Kubectl cannot modify kubelet host-level configuration such as `/var/lib/kubelet/config.yaml` or the systemd unit files on worker nodes. To remediate this finding, make the changes directly on each worker node’s filesystem and systemd configuration as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediate CIS AKS 3.2.7 on every worker node:
        # Ensure kubelet eventRecordQPS is set to an appropriate value (default here: 5).
        #
        # Run this script ON EACH WORKER NODE as root.
        #

        set -euo pipefail

        EVENT_QPS_VALUE="5"
        KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
        SYSTEMD_DROPIN_DIR="/etc/systemd/system/kubelet.service.d"
        SYSTEMD_DROPIN_FILE="${SYSTEMD_DROPIN_DIR}/10-kubeadm.conf"

        echo "==> Ensuring kubelet eventRecordQPS is set to ${EVENT_QPS_VALUE}"

        # 1. Ensure kubelet config file exists
        if [[ ! -f "${KUBELET_CONFIG}" ]]; then
          echo "ERROR: ${KUBELET_CONFIG} not found on this node."
          echo "This script expects kubelet to be configured via ${KUBELET_CONFIG}."
          exit 1
        fi

        # 2. Backup kubelet config
        if [[ ! -f "${KUBELET_CONFIG}.cisbak" ]]; then
          cp "${KUBELET_CONFIG}" "${KUBELET_CONFIG}.cisbak"
          echo "Backup created at ${KUBELET_CONFIG}.cisbak"
        fi

        # 3. Update eventRecordQPS in kubelet config.yaml (idempotent)
        if grep -qE '^\s*eventRecordQPS:' "${KUBELET_CONFIG}"; then
          # Replace existing setting
          sed -i -E "s/^\s*eventRecordQPS:.*/eventRecordQPS: ${EVENT_QPS_VALUE}/" "${KUBELET_CONFIG}"
        else
          # Add setting under top-level (no strict YAML reformatting)
          echo "eventRecordQPS: ${EVENT_QPS_VALUE}" >> "${KUBELET_CONFIG}"
        fi
        echo "Updated ${KUBELET_CONFIG} with eventRecordQPS: ${EVENT_QPS_VALUE}"

        # 4. Ensure no conflicting --eventRecordQPS in kubelet systemd drop-in
        if [[ -d "${SYSTEMD_DROPIN_DIR}" && -f "${SYSTEMD_DROPIN_FILE}" ]]; then
          if grep -q -- "--eventRecordQPS" "${SYSTEMD_DROPIN_FILE}"; then
            cp "${SYSTEMD_DROPIN_FILE}" "${SYSTEMD_DROPIN_FILE}.cisbak" || true
            # Remove any --eventRecordQPS=... occurrences from KUBELET_KUBEADM_ARGS / KUBELET_ARGS lines
            sed -i -E 's/--eventRecordQPS=[^ "]*//g' "${SYSTEMD_DROPIN_FILE}"
            # Clean up double spaces left behind
            sed -i -E 's/  +/ /g' "${SYSTEMD_DROPIN_FILE}"
            echo "Removed conflicting --eventRecordQPS flags from ${SYSTEMD_DROPIN_FILE}"
          fi
        else
          echo "Note: ${SYSTEMD_DROPIN_FILE} not found; no systemd kubelet drop-in to clean."
        fi

        # 5. Reload and restart kubelet
        echo "==> Restarting kubelet"
        systemctl daemon-reload
        systemctl restart kubelet.service

        # Wait briefly for kubelet to restart
        sleep 5

        # 6. Verification: show kubelet process flags and confirm effective configuration
        echo "==> Verification: kubelet process (ps)"
        /bin/ps -fC kubelet || {
          echo "ERROR: kubelet process not found after restart."
          systemctl status kubelet -l || true
          exit 1
        }

        echo "==> Verification: checking effective kubelet config for eventRecordQPS"
        if grep -qE "^\s*eventRecordQPS:\s*${EVENT_QPS_VALUE}\b" "${KUBELET_CONFIG}"; then
          echo "PASS: ${KUBELET_CONFIG} has eventRecordQPS: ${EVENT_QPS_VALUE}"
        else
          echo "WARN: ${KUBELET_CONFIG} does not show eventRecordQPS: ${EVENT_QPS_VALUE}"
        fi

        # Extra check: ensure no --eventRecordQPS in kubelet args (to avoid overriding file)
        if /bin/ps -fC kubelet | grep -q -- "--eventRecordQPS"; then
          echo "WARN: kubelet process still has a --eventRecordQPS flag."
          echo "Inspect systemd unit and environment for overrides:"
          echo "  systemctl cat kubelet"
          echo "  systemctl show kubelet -p Environment"
        else
          echo "PASS: kubelet process has no overriding --eventRecordQPS flag."
        fi

        echo "==> Completed CIS AKS 3.2.7 remediation on this worker node."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>