Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-1883

Allow cluster admins to modify the value for --terminated-pod-gc-threshold

    XMLWordPrintable

Details

    • False
    • False
    • Undefined
    • 6,012

    Description

      1. Proposed title of this feature request

      Allow cluster admins to modify the value for --terminated-pod-gc-threshold

      2. What is the nature and description of the request?

      The CIS Kubernetes benchmark v1.6, item 1.3.1 (part of the guidance for the Controller manager) states
      "Garbage collection is important to ensure sufficient resource availability and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. The current setting for garbage collection is 12,500 terminated pods which might be too high for your system to sustain. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection."
       
      As of OpenShift 4.7, OpenShift uses the default value of 12,500 terminated pods, the setting is not exposed and cannot be modified by a cluster admin.
      We do provide options to configure garbage collection for images of terminated containers on the nodes, but providing the ability to adjust the setting for --terminated-pod-gc-threshold would allow admins to have more control over reclaiming space in etcd.

      3. Why does the customer need this? (List the business requirements here)

      The customer's security team requires use of the CIS Kubernetes benchmark for hardening. The OpenShift 4 Hardening Guide 1.0 (https://pnt.redhat.com/pnt/p-18428165/Red_Hat_OpenS...uide_v1.0.pdf) incorrectly provides guidance to use the node garbage collection settings to meet this CIS guidance. The customer would like corrected guidance. 

      4. List any affected packages or components.

      Kube Controller Manager

      OpenShift Controller Manager

      Attachments

        Issue Links

          Activity

            People

              gausingh@redhat.com Gaurav Singh
              knewcome@redhat.com Kirsten Newcomer
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: