Skip to main content

Ensure Hostname Override Argument Is Not Set

More Info:​

Do not override node hostnames.

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AKS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. Check current kubelet arguments (every worker node)

    /bin/ps -fC kubelet

    Confirm whether --hostname-override appears in the kubelet command.

  2. Open the kubelet systemd drop-in for editing (every worker node)

    sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

  3. Remove the hostname override option (every worker node)
    In the opened file, locate the line that defines KUBELET_SYSTEM_PODS_ARGS (or other KUBELET_* variable) and remove the --hostname-override=... argument from it.
    Save and exit the editor.

  4. Reload systemd config (every worker node)

    sudo systemctl daemon-reload

  5. Restart kubelet (every worker node)

    sudo systemctl restart kubelet.service

  6. Verify kubelet is running without hostname override (every worker node)

    /bin/ps -fC kubelet | grep -v grep

    Confirm that the kubelet process command line no longer contains --hostname-override.

Using kubectl

kubectl cannot modify kubelet process flags or host-level configuration files such as /etc/systemd/system/kubelet.service.d/10-kubeadm.conf or /var/lib/kubelet/config.yaml. To remediate this finding, make the changes directly on every worker node as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
#
# Remediate CIS AKS 3.2.8: Ensure --hostname-override is not set for kubelet
#
# Usage: run on each worker node as root (or with sudo):
#   sudo bash ./fix-kubelet-hostname-override.sh
#
# Idempotent: safe to re-run.

set -euo pipefail

UNIT_DIR="/etc/systemd/system/kubelet.service.d"
UNIT_FILE="${UNIT_DIR}/10-kubeadm.conf"

echo "==> Checking for kubelet systemd drop-in at ${UNIT_FILE}"

if [[ ! -f "${UNIT_FILE}" ]]; then
  echo "ERROR: ${UNIT_FILE} not found. This script only handles systemd-based kubelet with kubeadm-style config."
  echo "Please review your kubelet systemd unit manually."
  exit 1
fi

backup_file() {
  local src="$1"
  local ts
  ts="$(date +%Y%m%d%H%M%S)"
  local dst="${src}.bak-${ts}"
  cp -p "${src}" "${dst}"
  echo "   Backup created: ${dst}"
}

echo "==> Backing up kubelet drop-in file"
backup_file "${UNIT_FILE}"

echo "==> Removing any --hostname-override occurrences from ${UNIT_FILE}"
# Remove any argument containing --hostname-override (with or without =)
# This keeps the rest of the line intact.
tmpfile="$(mktemp)"
sed -E 's/([[:space:]]|^)--hostname-override(=[^[:space:]]*)?//g' "${UNIT_FILE}" > "${tmpfile}"

# Normalize multiple spaces to single spaces on ExecStart/KUBELET_SYSTEM_PODS_ARGS lines
sed -E -i \
  -e '/KUBELET_SYSTEM_PODS_ARGS|ExecStart/ s/[[:space:]]+/ /g' \
  -e '/KUBELET_SYSTEM_PODS_ARGS|ExecStart/ s/ [[:space:]]*$//' \
  "${tmpfile}"

# Only replace file if it actually changed
if cmp -s "${UNIT_FILE}" "${tmpfile}"; then
  echo "   No changes needed; --hostname-override not present."
  rm -f "${tmpfile}"
else
  mv "${tmpfile}" "${UNIT_FILE}"
  echo "   Updated ${UNIT_FILE} to remove --hostname-override."
fi

echo "==> Reloading systemd daemon"
systemctl daemon-reload

echo "==> Restarting kubelet (this will temporarily disrupt workloads on this node)"
systemctl restart kubelet.service

echo "==> Verifying kubelet process does not use --hostname-override"
sleep 3

if /bin/ps -fC kubelet | grep -q -- '--hostname-override'; then
  echo "FAIL: kubelet is still running with --hostname-override."
  echo "Current kubelet process:"
  /bin/ps -fC kubelet || true
  exit 1
fi

echo "PASS: kubelet is running without --hostname-override."
/bin/ps -fC kubelet || true

Additional Reading:​