> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet Event QPS Argument Set For Appropriate Event Capture

### More Info:

The kubelet --event-qps argument should be set to a level that ensures appropriate event capture. Proper event capture supports auditing and troubleshooting of node activity.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS OKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, open the kubelet systemd drop-in configuration for editing:

           ```bash theme={null}
           sudo vi /etc/systemd/system/kubelet.service.d/00-default.conf
           ```

        2. In the `ExecStart=` line, add or adjust the `--event-qps` flag so it is explicitly set to 0 (or your chosen value that ensures appropriate capture). For example:

           ```ini theme={null}
           ExecStart=/usr/bin/kubelet \
             --event-qps=0 \
             ...
           ```

           Ensure there is only one `--event-qps` flag present.

        3. If your kubelet also uses a config file at `/etc/kubernetes/kubelet-config.json`, ensure it does not conflict. Either remove any `eventQPS` entry or set it consistently:

           ```bash theme={null}
           sudo vi /etc/kubernetes/kubelet-config.json
           ```

           Example JSON snippet:

           ```json theme={null}
           {
             "eventQPS": 0
           }
           ```

        4. Reload systemd configuration on the worker node:

           ```bash theme={null}
           sudo systemctl daemon-reload
           ```

        5. Restart kubelet on the worker node (note: this briefly disrupts the node’s workloads):

           ```bash theme={null}
           sudo systemctl restart kubelet.service
           sudo systemctl status kubelet -l
           ```

        6. Verify on the worker node that kubelet is running with the desired `--event-qps` setting:

           ```bash theme={null}
           /bin/ps -fC kubelet
           ```

           Confirm the output includes `--event-qps=0` (or your chosen value).
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify kubelet process flags or the `/etc/kubernetes/kubelet-config.json` and systemd unit files on worker nodes. To remediate this finding, you must change the kubelet configuration on each worker node’s host OS (for example, `/etc/systemd/system/kubelet.service.d/00-default.conf` and the kubelet config file) as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Remediate CIS OKE 3.2.7: ensure kubelet --event-qps=0 (every worker node)
        # Run on each worker node as root.

        set -euo pipefail

        KUBELET_DROPIN_DIR="/etc/systemd/system/kubelet.service.d"
        KUBELET_DROPIN_FILE="${KUBELET_DROPIN_DIR}/00-default.conf"
        TARGET_FLAG="--event-qps=0"

        echo "[INFO] Ensuring kubelet drop-in directory exists: ${KUBELET_DROPIN_DIR}"
        mkdir -p "${KUBELET_DROPIN_DIR}"

        echo "[INFO] Ensuring ${KUBELET_DROPIN_FILE} exists"
        touch "${KUBELET_DROPIN_FILE}"

        echo "[INFO] Updating/adding ${TARGET_FLAG} in kubelet systemd drop-in"

        # Ensure an Environment= line that contains KUBELET_KUBEADM_ARGS exists,
        # then ensure it contains the desired flag and no conflicting --event-qps.
        if grep -q 'Environment=.*KUBELET_KUBEADM_ARGS' "${KUBELET_DROPIN_FILE}"; then
          # Remove any existing --event-qps=... from that line, then append the correct flag if missing.
          sed -i \
            -e '/Environment=.*KUBELET_KUBEADM_ARGS/{
              s/--event-qps=[^" ]*//g
            }' \
            "${KUBELET_DROPIN_FILE}"

          if ! grep -q 'Environment=.*KUBELET_KUBEADM_ARGS.*--event-qps=0' "${KUBELET_DROPIN_FILE}"; then
            sed -i \
              -e '/Environment=.*KUBELET_KUBEADM_ARGS/{
                s/"$/ '"${TARGET_FLAG}"'"/
              }' \
              "${KUBELET_DROPIN_FILE}"
          fi
        else
          # No KUBELET_KUBEADM_ARGS line yet; append one with the desired flag.
          cat <<EOF >> "${KUBELET_DROPIN_FILE}"
        [Service]
        Environment="KUBELET_KUBEADM_ARGS=${TARGET_FLAG}"
        EOF
        fi

        echo "[INFO] Reloading systemd and restarting kubelet"
        systemctl daemon-reload
        systemctl restart kubelet.service

        echo "[INFO] Checking kubelet status"
        systemctl status kubelet.service -l --no-pager || true

        echo "[INFO] Verifying kubelet process flags contain ${TARGET_FLAG} and no conflicting --event-qps"
        ps_output="$(/bin/ps -fC kubelet || true)"

        echo "${ps_output}"

        if ! grep -q -- "${TARGET_FLAG}" <<< "${ps_output}"; then
          echo "[ERROR] kubelet is not running with ${TARGET_FLAG}." >&2
          exit 1
        fi

        if grep -q -- "--event-qps=" <<< "${ps_output}" && ! grep -q -- "--event-qps=0" <<< "${ps_output}"; then
          echo "[ERROR] kubelet is running with a conflicting --event-qps value." >&2
          exit 1
        fi

        echo "[INFO] Verification succeeded: kubelet is running with ${TARGET_FLAG}"
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>