Skip to main content

Ensure Hostname Override Argument Is Not Set

More Info:​

Do not override node hostnames.

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS EKS
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check how kubelet is started and whether --hostname-override is present:

    /bin/ps -fC kubelet

    Note whether kubelet is started via systemd and if --hostname-override appears in the command.

  2. On every worker node, open the kubelet systemd drop-in file for editing:

    sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

  3. In that file, locate any line that includes --hostname-override (commonly within a variable like KUBELET_SYSTEM_PODS_ARGS=) and remove only the --hostname-override=... portion, leaving the rest of the arguments unchanged. Save and exit.

  4. Still on the same worker node, reload systemd and restart kubelet so the change takes effect:

    sudo systemctl daemon-reload
    sudo systemctl restart kubelet.service

  5. If /var/lib/kubelet/config.yaml contains a hostnameOverride field, remove it as well to avoid configuration drift:

    sudo vi /var/lib/kubelet/config.yaml

    Delete the hostnameOverride: ... line, save, and restart kubelet again:

    sudo systemctl restart kubelet.service

  6. Verify on each worker node that kubelet is running without --hostname-override:

    /bin/ps -fC kubelet | grep -- '--hostname-override' || echo "No hostname-override flag set"
Using kubectl

kubectl cannot modify kubelet process flags or host-level configuration files such as /etc/systemd/system/kubelet.service.d/10-kubeadm.conf or /var/lib/kubelet/config.yaml. To remediate this finding, make the changes directly on every worker node’s filesystem and systemd configuration as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
#
# automate_kubelet_hostname_override_removal.sh
#
# Usage:
#   Run on each worker node as root (or with sudo):
#     sudo bash automate_kubelet_hostname_override_removal.sh
#
# Idempotent:
#   - Safely edits /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
#   - Removes any --hostname-override argument from KUBELET_SYSTEM_PODS_ARGS (or any KUBELET_* vars)
#   - Reloads and restarts kubelet only if a change was made
#   - Verifies kubelet is running without --hostname-override

set -euo pipefail

SERVICE_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
BACKUP_SUFFIX=".pre_hostname_override_removal.$(date +%Y%m%d%H%M%S)"

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: This script must be run as root (use sudo)." >&2
  exit 1
fi

if [[ ! -f "$SERVICE_DROPIN" ]]; then
  echo "WARN: $SERVICE_DROPIN not found on this node; nothing to change."
  echo "Verification: kubelet process (if present) should not include --hostname-override."
  ps -fC kubelet || true
  exit 0
fi

ORIG_CONTENT="$(cat "$SERVICE_DROPIN")"

# Function to strip --hostname-override (and its value) from a line
strip_hostname_override() {
  # Works for:
  #   --hostname-override=value
  #   --hostname-override value
  # in any position within the line.
  python3 - "$1" << 'PYEOF'
import sys, shlex

line = sys.argv[1]
try:
    tokens = shlex.split(line)
except ValueError:
    print(line)
    sys.exit(0)

result = []
skip_next = False
for i, t in enumerate(tokens):
    if skip_next:
        skip_next = False
        continue
    if t.startswith("--hostname-override="):
        continue
    if t == "--hostname-override":
        if i + 1 < len(tokens):
            skip_next = True
        continue
    result.append(t)

if not result:
    print("")
else:
    # Preserve original quoting style minimally by rejoining with spaces
    print(" ".join(result))
PYEOF
}

TMP_FILE="$(mktemp)"
trap 'rm -f "$TMP_FILE"' EXIT

changed=0

while IFS= read -r line; do
  if echo "$line" | grep -q 'KUBELET_.*=.*--hostname-override'; then
    key="${line%%=*}"
    val="${line#*=}"
    stripped_val="$(strip_hostname_override "$val")"
    # Clean up potential multiple spaces
    stripped_val="$(printf '%s\n' "$stripped_val" | sed -E 's/[[:space:]]+/ /g')"
    new_line="${key}=${stripped_val}"
    echo "$new_line" >> "$TMP_FILE"
    if [[ "$new_line" != "$line" ]]; then
      changed=1
    fi
  else
    echo "$line" >> "$TMP_FILE"
  fi
done <<< "$ORIG_CONTENT"

if [[ $changed -eq 0 ]]; then
  echo "No --hostname-override argument found in $SERVICE_DROPIN; no changes made."
else
  cp "$SERVICE_DROPIN" "${SERVICE_DROPIN}${BACKUP_SUFFIX}"
  mv "$TMP_FILE" "$SERVICE_DROPIN"
  chmod --reference="${SERVICE_DROPIN}${BACKUP_SUFFIX}" "$SERVICE_DROPIN" || true
  chown --reference="${SERVICE_DROPIN}${BACKUP_SUFFIX}" "$SERVICE_DROPIN" || true

  echo "Removed --hostname-override from $SERVICE_DROPIN"
  echo "Reloading systemd and restarting kubelet (this will restart the kubelet on this node)..."
  systemctl daemon-reload
  systemctl restart kubelet.service
fi

# Verification: ensure kubelet is running and has no --hostname-override flag
echo "Verification: kubelet process and flags on this node:"
if ! ps -fC kubelet >/dev/null 2>&1; then
  echo "ERROR: kubelet process not found after changes." >&2
  ps -fC kubelet || true
  exit 1
fi

ps -fC kubelet
if ps -fC kubelet | grep -q -- "--hostname-override"; then
  echo "ERROR: kubelet is still running with --hostname-override; manual review required." >&2
  exit 1
fi

echo "Success: kubelet is running without --hostname-override on this worker node."

Additional Reading:​