> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Hostname Override Argument Is Not Set

### More Info:

Do not override node hostnames.

### Risk Level

High

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CIS EKS
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check how kubelet is started and whether `--hostname-override` is present:
           ```bash theme={null}
           /bin/ps -fC kubelet
           ```
           Note whether kubelet is started via systemd and if `--hostname-override` appears in the command.

        2. On every worker node, open the kubelet systemd drop-in file for editing:
           ```bash theme={null}
           sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```

        3. In that file, locate any line that includes `--hostname-override` (commonly within a variable like `KUBELET_SYSTEM_PODS_ARGS=`) and remove only the `--hostname-override=...` portion, leaving the rest of the arguments unchanged. Save and exit.

        4. Still on the same worker node, reload systemd and restart kubelet so the change takes effect:
           ```bash theme={null}
           sudo systemctl daemon-reload
           sudo systemctl restart kubelet.service
           ```

        5. If `/var/lib/kubelet/config.yaml` contains a `hostnameOverride` field, remove it as well to avoid configuration drift:
           ```bash theme={null}
           sudo vi /var/lib/kubelet/config.yaml
           ```
           Delete the `hostnameOverride: ...` line, save, and restart kubelet again:
           ```bash theme={null}
           sudo systemctl restart kubelet.service
           ```

        6. Verify on each worker node that kubelet is running without `--hostname-override`:
           ```bash theme={null}
           /bin/ps -fC kubelet | grep -- '--hostname-override' || echo "No hostname-override flag set"
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify kubelet process flags or host-level configuration files such as `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` or `/var/lib/kubelet/config.yaml`. To remediate this finding, make the changes directly on every worker node’s filesystem and systemd configuration as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # automate_kubelet_hostname_override_removal.sh
        #
        # Usage:
        #   Run on each worker node as root (or with sudo):
        #     sudo bash automate_kubelet_hostname_override_removal.sh
        #
        # Idempotent:
        #   - Safely edits /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
        #   - Removes any --hostname-override argument from KUBELET_SYSTEM_PODS_ARGS (or any KUBELET_* vars)
        #   - Reloads and restarts kubelet only if a change was made
        #   - Verifies kubelet is running without --hostname-override

        set -euo pipefail

        SERVICE_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
        BACKUP_SUFFIX=".pre_hostname_override_removal.$(date +%Y%m%d%H%M%S)"

        if [[ $EUID -ne 0 ]]; then
          echo "ERROR: This script must be run as root (use sudo)." >&2
          exit 1
        fi

        if [[ ! -f "$SERVICE_DROPIN" ]]; then
          echo "WARN: $SERVICE_DROPIN not found on this node; nothing to change."
          echo "Verification: kubelet process (if present) should not include --hostname-override."
          ps -fC kubelet || true
          exit 0
        fi

        ORIG_CONTENT="$(cat "$SERVICE_DROPIN")"

        # Function to strip --hostname-override (and its value) from a line
        strip_hostname_override() {
          # Works for:
          #   --hostname-override=value
          #   --hostname-override value
          # in any position within the line.
          python3 - "$1" << 'PYEOF'
        import sys, shlex

        line = sys.argv[1]
        try:
            tokens = shlex.split(line)
        except ValueError:
            print(line)
            sys.exit(0)

        result = []
        skip_next = False
        for i, t in enumerate(tokens):
            if skip_next:
                skip_next = False
                continue
            if t.startswith("--hostname-override="):
                continue
            if t == "--hostname-override":
                if i + 1 < len(tokens):
                    skip_next = True
                continue
            result.append(t)

        if not result:
            print("")
        else:
            # Preserve original quoting style minimally by rejoining with spaces
            print(" ".join(result))
        PYEOF
        }

        TMP_FILE="$(mktemp)"
        trap 'rm -f "$TMP_FILE"' EXIT

        changed=0

        while IFS= read -r line; do
          if echo "$line" | grep -q 'KUBELET_.*=.*--hostname-override'; then
            key="${line%%=*}"
            val="${line#*=}"
            stripped_val="$(strip_hostname_override "$val")"
            # Clean up potential multiple spaces
            stripped_val="$(printf '%s\n' "$stripped_val" | sed -E 's/[[:space:]]+/ /g')"
            new_line="${key}=${stripped_val}"
            echo "$new_line" >> "$TMP_FILE"
            if [[ "$new_line" != "$line" ]]; then
              changed=1
            fi
          else
            echo "$line" >> "$TMP_FILE"
          fi
        done <<< "$ORIG_CONTENT"

        if [[ $changed -eq 0 ]]; then
          echo "No --hostname-override argument found in $SERVICE_DROPIN; no changes made."
        else
          cp "$SERVICE_DROPIN" "${SERVICE_DROPIN}${BACKUP_SUFFIX}"
          mv "$TMP_FILE" "$SERVICE_DROPIN"
          chmod --reference="${SERVICE_DROPIN}${BACKUP_SUFFIX}" "$SERVICE_DROPIN" || true
          chown --reference="${SERVICE_DROPIN}${BACKUP_SUFFIX}" "$SERVICE_DROPIN" || true

          echo "Removed --hostname-override from $SERVICE_DROPIN"
          echo "Reloading systemd and restarting kubelet (this will restart the kubelet on this node)..."
          systemctl daemon-reload
          systemctl restart kubelet.service
        fi

        # Verification: ensure kubelet is running and has no --hostname-override flag
        echo "Verification: kubelet process and flags on this node:"
        if ! ps -fC kubelet >/dev/null 2>&1; then
          echo "ERROR: kubelet process not found after changes." >&2
          ps -fC kubelet || true
          exit 1
        fi

        ps -fC kubelet
        if ps -fC kubelet | grep -q -- "--hostname-override"; then
          echo "ERROR: kubelet is still running with --hostname-override; manual review required." >&2
          exit 1
        fi

        echo "Success: kubelet is running without --hostname-override on this worker node."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kubelet/](https://kubernetes.io/docs/admin/kubelet/)