# Ensure that the --streaming-connection-idle-timeout argument is not set to 0

- Source: https://support.icompaas.com/support/solutions/articles/62000234595-ensure-that-the-streaming-connection-idle-timeout-argument-is-not-set-to-0
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Azure Kubernetes Service (AKS) Benchmark v1.7.0](https://support.icompaas.com/support/solutions/62000112691) › [Azure Kubernetes Service (AKS) Benchmark](https://support.icompaas.com/support/solutions/folders/62000169257)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability****:**

-   **Level 1**  
    

**Description:** The --streaming-connection-idle-timeout flag in Kubernetes determines the amount of time a streaming connection to the API server is allowed to remain idle before being closed. Setting this argument to 0 disables the idle timeout, potentially leading to resource exhaustion as idle connections will remain open indefinitely. This check ensures that the timeout is set to a reasonable value to protect resources and maintain the health of the API server.

**Rationale:** Setting the --streaming-connection-idle-timeout to 0 allows idle connections to persist without closure, which can lead to a build-up of unused connections, consuming resources unnecessarily. A proper timeout value ensures that connections are closed after a period of inactivity, which helps in resource management and improves server stability.

**Impact:**

-   **Pros:**  
    
    -   Reduces the risk of resource exhaustion by ensuring idle connections are closed.
        
    -   Helps maintain a healthy Kubernetes API server by automatically closing unused connections.
        
-   **Cons:**  
    
    -   If set to a value too low, it might disconnect active but low-traffic connections, potentially disrupting services.
        

**Default Value:** The default value may vary depending on the Kubernetes version and configuration, but a reasonable value should be set to avoid idle connections.

Pre-requisites: Ensure that the appropriate timeout value is configured based on the organization's workload and expected connection behavior.

**Remediation**

### **Test Plan:**

**Using Azure Console:**

1.  Access the Kubernetes cluster configuration settings.
    
2.  Review the kube-apiserver configuration to check if the \--streaming-connection-idle-timeout is set to a non-zero value.
    

**Using Azure CLI:**

1.  Use the following command to check the current configuration of the \--streaming-connection-idle-timeout:  
    
     ps aux | grep kube-apiserver
    
2.  Ensure that the \--streaming-connection-idle-timeout argument is not set to 0.
    

### **Implementation Plan:**

**Using Azure Console:**

1.  Access the kube-apiserver configuration.
    
2.  Set the \--streaming-connection-idle-timeout to a non-zero value (e.g., 5m for 5 minutes) to ensure proper resource management.
    

**Using Azure CLI:**

1.  Update the \--streaming-connection-idle-timeout flag by modifying the kube-apiserver configuration:
    
     kubectl -n kube-system edit deployment kube-apiserver
    
2.  Set the \--streaming-connection-idle-timeout to an appropriate value (e.g., \--streaming-connection-idle-timeout=5m).
    

### **Backout Plan:**

**Using Azure Console:**

1.  If the change causes issues, revert the \--streaming-connection-idle-timeout to its original configuration or adjust the timeout value as necessary.
    

**Using Azure CLI:**

1.  Revert the \--streaming-connection-idle-timeout flag by modifying the configuration:
    
    kubectl -n kube-system edit deployment kube-apiserver
    
2.  Set the timeout to a value of 0 if required temporarily.
    

### References:

1.  [Kubernetes API Server Configuration  
      
    ](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.