1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
documentation_complete: true
title: 'Enable the APIPriorityAndFairness feature gate'
description: |-
To limit the rate at which the API Server accepts requests, make
sure that the API Priority and Fairness feature is enabled.
Using <tt>APIPriorityAndFairness</tt> feature provides a fine-grained way
to control the behaviour of the Kubernetes API server in an overload
situation. To enable the <tt>APIPriorityAndFairness</tt> feature gate,
make sure that the <tt>feature-gates</tt> API server argument, typically
set in the <tt>config</tt> configMap in the <tt>openshift-kube-apiserver</tt>
namespace contains <tt>APIPriorityAndFairness=true</tt>.
Note that since Kubernetes 1.20, this feature gate is enabled by default.
As a result, this rule is only applicable to OpenShift releases prior
to 4.7 which was the first OCP release to ship Kubernetes 1.20.
rationale: |-
The <tt>APIPriorityAndFairness</tt> feature gate enables the use of the
<tt>FlowSchema</tt> API objects which enforce a limit on the number of
events that the API Server will accept in a given time slice In a large
multi-tenant cluster, there might be a small percentage of misbehaving
tenants which could have a significant impact on the performance of
the cluster overall. It is recommended to limit the rate of events
that the API Server will accept.
identifiers:
cce@ocp4: CCE-83656-9
severity: medium
platform: not ocp4-on-hypershift-hosted and ocp4.6
ocil_clause: '<tt>.apiServerArguments["feature-gates"]</tt> does not include <tt>APIPriorityAndFairness</tt>'
ocil: |-
To verify that <tt>APIPriorityAndFairness</tt> is enabled, run the following command:
<pre>oc get kubeapiservers.operator.openshift.io cluster -o json | jq '.spec.observedConfig.apiServerArguments["feature-gates"]'</pre>
The output should contain "APIPriorityAndFairness=true"
warnings:
- general: |-
{{{ openshift_cluster_setting("/apis/operator.openshift.io/v1/kubeapiservers/cluster") | indent(4) }}}
template:
name: yamlfile_value
vars:
ocp_data: "true"
filepath: '/apis/operator.openshift.io/v1/kubeapiservers/cluster'
yamlpath: '.spec.observedConfig.apiServerArguments["feature-gates"][:]'
values:
- value: '^APIPriorityAndFairness=true$'
type: "string"
operation: "pattern match"
entity_check: "at least one"
|
