Skip to main content

Ensure Make Ptables Util Chains Argument Is Enabled

More Info:​

Allow Kubelet to manage iptables.

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AKS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps
  1. On every worker node, back up the current kubelet config and systemd drop-in (if present):
sudo cp -a /var/lib/kubelet/config.yaml /var/lib/kubelet/config.yaml.bak.$(date +%F-%H%M%S) || true
sudo cp -a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf /etc/systemd/system/kubelet.service.d/10-kubeadm.conf.bak.$(date +%F-%H%M%S) 2>/dev/null || true
  1. On every worker node, edit the kubelet config file to ensure makeIPTablesUtilChains is set to true:
sudo vi /var/lib/kubelet/config.yaml

Add or modify the line in the top-level YAML (align indentation with other boolean options):

makeIPTablesUtilChains: true

Save and exit.

  1. On every worker node, remove any explicit --make-iptables-util-chains flag from the kubelet systemd drop-in so the config file setting is authoritative:
sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

In any line that contains --make-iptables-util-chains, remove that argument completely (do not leave a trailing backslash). Save and exit.

  1. On every worker node, reload systemd and restart kubelet for the changes to take effect:
sudo systemctl daemon-reload
sudo systemctl restart kubelet.service
  1. On every worker node, verify the kubelet process is running and no --make-iptables-util-chains override is present, confirming that the config file setting will apply:
/bin/ps -fC kubelet

Check the output command line for kubelet and ensure:

  • There is no --make-iptables-util-chains argument.
  • The process is running (a kubelet line is present).
Using kubectl

kubectl cannot modify kubelet process flags or the kubelet config file on worker nodes, so this finding cannot be fixed via Kubernetes API objects. To remediate, adjust /var/lib/kubelet/config.yaml or the kubelet systemd unit on every worker node as described, and follow the guidance in the Manual Steps section.

Automation
#!/usr/bin/env bash
# Remediation: Ensure Kubelet makeIPTablesUtilChains is enabled (CIS AKS 3.2.7)
# Target: every worker node
# Run on: every worker node (as root)

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"

echo "==> Ensuring kubelet makeIPTablesUtilChains is enabled"

############################################
# 1) Ensure config file has makeIPTablesUtilChains: true
############################################
if [ -f "$KUBELET_CONFIG" ]; then
  echo "-> Found kubelet config file at $KUBELET_CONFIG"

  if grep -qE '^[[:space:]]*makeIPTablesUtilChains[[:space:]]*:' "$KUBELET_CONFIG"; then
    # Key exists: set to true
    echo "   Updating existing makeIPTablesUtilChains entry to true"
    # Replace the line regardless of current value/spacing
    sed -i -E 's/^[[:space:]]*makeIPTablesUtilChains[[:space:]]*:.*/makeIPTablesUtilChains: true/' "$KUBELET_CONFIG"
  else
    # Key missing: append at end (YAML root-level)
    echo "   Adding makeIPTablesUtilChains: true to config"
    printf '\nmakeIPTablesUtilChains: true\n' >> "$KUBELET_CONFIG"
  fi
else
  echo "WARNING: Kubelet config file $KUBELET_CONFIG not found; this script assumes config-file-based setup."
fi

############################################
# 2) Remove any --make-iptables-util-chains flag from systemd drop-in
############################################
if [ -f "$SYSTEMD_DROPIN" ]; then
  echo "-> Checking systemd drop-in $SYSTEMD_DROPIN for --make-iptables-util-chains"

  if grep -q -- '--make-iptables-util-chains' "$SYSTEMD_DROPIN"; then
    echo "   Removing --make-iptables-util-chains from drop-in"
    # Remove the argument token safely from ExecStart lines
    sed -i -E 's/[[:space:]]*--make-iptables-util-chains(=[^[:space:]]*)?//g' "$SYSTEMD_DROPIN"
  else
    echo "   No --make-iptables-util-chains flag found in drop-in (nothing to change)"
  fi
else
  echo "INFO: Systemd drop-in $SYSTEMD_DROPIN not found; skipping flag cleanup"
fi

############################################
# 3) Reload systemd and restart kubelet
############################################
echo "-> Reloading systemd and restarting kubelet (this will restart the kubelet process)"
systemctl daemon-reload
systemctl restart kubelet.service

############################################
# 4) Verification
############################################
echo "==> Verifying kubelet is running with makeIPTablesUtilChains from config file"

# Show kubelet process
/bin/ps -fC kubelet || {
  echo "ERROR: kubelet process not found after restart"
  exit 1
}

# Verify config file value if present
if [ -f "$KUBELET_CONFIG" ]; then
  if grep -qE '^[[:space:]]*makeIPTablesUtilChains[[:space:]]*:[[:space:]]*true[[:space:]]*$' "$KUBELET_CONFIG"; then
    echo "OK: $KUBELET_CONFIG has makeIPTablesUtilChains: true"
  else
    echo "ERROR: $KUBELET_CONFIG does not have makeIPTablesUtilChains: true"
    exit 1
  fi
else
  echo "WARNING: $KUBELET_CONFIG still missing; ensure kubelet is not configured solely via flags for this control."
fi

# Confirm kubelet is NOT started with an explicit --make-iptables-util-chains flag
if /bin/ps -o args= -C kubelet | grep -q -- '--make-iptables-util-chains'; then
  echo "ERROR: kubelet is still started with an explicit --make-iptables-util-chains flag; remove it from all systemd drop-ins."
  /bin/ps -o args= -C kubelet
  exit 1
else
  echo "OK: kubelet command line has no explicit --make-iptables-util-chains flag (uses config file setting)"
fi

echo "==> Remediation complete for this node"

Additional Reading:​