Skip to main content

Ensure Hostname Override Argument Is Not Set

More Info:​

Do not override node hostnames.

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS GKE
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, inspect the current kubelet process to confirm --hostname-override is in use:

    /bin/ps -fC kubelet

    Look for --hostname-override= in the command line.

  2. On every worker node, open the kubelet systemd drop-in file for editing:

    sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

  3. In that file, locate the line that defines extra kubelet args (commonly Environment="KUBELET_SYSTEM_PODS_ARGS=..." or similar) and remove the --hostname-override=... argument from the value. Save and exit the editor.

  4. On every worker node, reload systemd and restart kubelet to apply the change:

    sudo systemctl daemon-reload
    sudo systemctl restart kubelet.service

  5. (If /var/lib/kubelet/config.yaml also contains a hostname override) On every worker node, edit the kubelet configuration file:

    sudo vi /var/lib/kubelet/config.yaml

    Remove any line that sets hostnameOverride: and save the file, then restart kubelet again:

    sudo systemctl restart kubelet.service

  6. Verify on every worker node that kubelet is now running without --hostname-override:

    /bin/ps -fC kubelet

    Confirm that --hostname-override no longer appears in the kubelet process arguments.

Using kubectl

kubectl cannot change the kubelet startup arguments or the host-level configuration at /etc/systemd/system/kubelet.service.d/10-kubeadm.conf or /var/lib/kubelet/config.yaml. To remove the --hostname-override flag, you must edit the kubelet service configuration directly on each worker node; follow the guidance in the Manual Steps section.

Automation
#!/usr/bin/env bash
# Automation: Remove --hostname-override from kubelet systemd config on all worker nodes
# Usage: ./fix_hostname_override.sh node1 node2 ...

set -euo pipefail

if [ "$#" -lt 1 ]; then
  echo "Usage: $0 <worker-node-1> [worker-node-2 ...]" >&2
  exit 1
fi

SSH_OPTS="-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10"

fix_node() {
  local NODE="$1"
  echo "=== Processing node: $NODE ==="

  ssh $SSH_OPTS "$NODE" 'bash -s' << 'EOF'
set -euo pipefail

SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
BACKUP_DIR="/etc/systemd/system/kubelet.service.d/backup_hostname_override_$(date +%Y%m%d)"
CHANGED=0

if [ ! -f "$SYSTEMD_DROPIN" ]; then
  echo "  [INFO] $SYSTEMD_DROPIN not found, nothing to change."
else
  mkdir -p "$BACKUP_DIR"

  # Backup original file once per run
  if [ ! -f "$BACKUP_DIR/10-kubeadm.conf.orig" ]; then
    cp "$SYSTEMD_DROPIN" "$BACKUP_DIR/10-kubeadm.conf.orig"
    echo "  [INFO] Backed up $SYSTEMD_DROPIN to $BACKUP_DIR/10-kubeadm.conf.orig"
  fi

  # Remove any --hostname-override arguments from the file
  TMP_FILE="$(mktemp)"
  if grep -q -- '--hostname-override' "$SYSTEMD_DROPIN"; then
    sed -E 's/--hostname-override[[:space:]]+[^[:space:]]+//g' "$SYSTEMD_DROPIN" > "$TMP_FILE"
    mv "$TMP_FILE" "$SYSTEMD_DROPIN"
    chmod 644 "$SYSTEMD_DROPIN"
    CHANGED=1
    echo "  [INFO] Removed --hostname-override from $SYSTEMD_DROPIN"
  else
    rm -f "$TMP_FILE"
    echo "  [INFO] No --hostname-override found in $SYSTEMD_DROPIN"
  fi
fi

# If /var/lib/kubelet/config.yaml contains hostnameOverride, remove it (GKE may use this file)
KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
if [ -f "$KUBELET_CONFIG" ]; then
  TMP_KCFG="$(mktemp)"
  if grep -q 'hostnameOverride' "$KUBELET_CONFIG"; then
    cp "$KUBELET_CONFIG" "$BACKUP_DIR/config.yaml.orig" 2>/dev/null || true
    # Remove any line containing hostnameOverride (simple safe approach)
    grep -v 'hostnameOverride' "$KUBELET_CONFIG" > "$TMP_KCFG"
    mv "$TMP_KCFG" "$KUBELET_CONFIG"
    chmod 600 "$KUBELET_CONFIG"
    CHANGED=1
    echo "  [INFO] Removed hostnameOverride from $KUBELET_CONFIG"
  else
    rm -f "$TMP_KCFG"
    echo "  [INFO] No hostnameOverride key found in $KUBELET_CONFIG"
  fi
else
  echo "  [INFO] $KUBELET_CONFIG not found, skipping."
fi

# Restart kubelet only if something changed
if [ "$CHANGED" -eq 1 ]; then
  echo "  [INFO] Reloading systemd and restarting kubelet (this will restart kubelet on this node)."
  systemctl daemon-reload
  systemctl restart kubelet.service
else
  echo "  [INFO] No changes detected; kubelet restart not required."
fi

echo "  [VERIFY] Checking kubelet process flags for --hostname-override"
if /bin/ps -fC kubelet | grep -q -- '--hostname-override'; then
  echo "  [FAIL] kubelet still running with --hostname-override:"
  /bin/ps -fC kubelet || true
  exit 1
else
  echo "  [OK] kubelet is running without --hostname-override."
fi

EOF

  echo "=== Completed node: $NODE ==="
  echo
}

for NODE in "$@"; do
  fix_node "$NODE"
done

echo "All specified nodes processed."

Additional Reading:​