> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Hostname Override Argument Is Not Set

### More Info:

Do not override node hostnames.

### Risk Level

High

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CIS GKE
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, inspect the current kubelet process to confirm `--hostname-override` is in use:
           ```bash theme={null}
           /bin/ps -fC kubelet
           ```
           Look for `--hostname-override=` in the command line.

        2. On every worker node, open the kubelet systemd drop-in file for editing:
           ```bash theme={null}
           sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```

        3. In that file, locate the line that defines extra kubelet args (commonly `Environment="KUBELET_SYSTEM_PODS_ARGS=..."` or similar) and remove the `--hostname-override=...` argument from the value. Save and exit the editor.

        4. On every worker node, reload systemd and restart kubelet to apply the change:
           ```bash theme={null}
           sudo systemctl daemon-reload
           sudo systemctl restart kubelet.service
           ```

        5. (If `/var/lib/kubelet/config.yaml` also contains a hostname override) On every worker node, edit the kubelet configuration file:
           ```bash theme={null}
           sudo vi /var/lib/kubelet/config.yaml
           ```
           Remove any line that sets `hostnameOverride:` and save the file, then restart kubelet again:
           ```bash theme={null}
           sudo systemctl restart kubelet.service
           ```

        6. Verify on every worker node that kubelet is now running without `--hostname-override`:
           ```bash theme={null}
           /bin/ps -fC kubelet
           ```
           Confirm that `--hostname-override` no longer appears in the kubelet process arguments.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change the kubelet startup arguments or the host-level configuration at `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` or `/var/lib/kubelet/config.yaml`. To remove the `--hostname-override` flag, you must edit the kubelet service configuration directly on each worker node; follow the guidance in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Automation: Remove --hostname-override from kubelet systemd config on all worker nodes
        # Usage: ./fix_hostname_override.sh node1 node2 ...

        set -euo pipefail

        if [ "$#" -lt 1 ]; then
          echo "Usage: $0 <worker-node-1> [worker-node-2 ...]" >&2
          exit 1
        fi

        SSH_OPTS="-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10"

        fix_node() {
          local NODE="$1"
          echo "=== Processing node: $NODE ==="

          ssh $SSH_OPTS "$NODE" 'bash -s' << 'EOF'
        set -euo pipefail

        SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
        BACKUP_DIR="/etc/systemd/system/kubelet.service.d/backup_hostname_override_$(date +%Y%m%d)"
        CHANGED=0

        if [ ! -f "$SYSTEMD_DROPIN" ]; then
          echo "  [INFO] $SYSTEMD_DROPIN not found, nothing to change."
        else
          mkdir -p "$BACKUP_DIR"

          # Backup original file once per run
          if [ ! -f "$BACKUP_DIR/10-kubeadm.conf.orig" ]; then
            cp "$SYSTEMD_DROPIN" "$BACKUP_DIR/10-kubeadm.conf.orig"
            echo "  [INFO] Backed up $SYSTEMD_DROPIN to $BACKUP_DIR/10-kubeadm.conf.orig"
          fi

          # Remove any --hostname-override arguments from the file
          TMP_FILE="$(mktemp)"
          if grep -q -- '--hostname-override' "$SYSTEMD_DROPIN"; then
            sed -E 's/--hostname-override[[:space:]]+[^[:space:]]+//g' "$SYSTEMD_DROPIN" > "$TMP_FILE"
            mv "$TMP_FILE" "$SYSTEMD_DROPIN"
            chmod 644 "$SYSTEMD_DROPIN"
            CHANGED=1
            echo "  [INFO] Removed --hostname-override from $SYSTEMD_DROPIN"
          else
            rm -f "$TMP_FILE"
            echo "  [INFO] No --hostname-override found in $SYSTEMD_DROPIN"
          fi
        fi

        # If /var/lib/kubelet/config.yaml contains hostnameOverride, remove it (GKE may use this file)
        KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
        if [ -f "$KUBELET_CONFIG" ]; then
          TMP_KCFG="$(mktemp)"
          if grep -q 'hostnameOverride' "$KUBELET_CONFIG"; then
            cp "$KUBELET_CONFIG" "$BACKUP_DIR/config.yaml.orig" 2>/dev/null || true
            # Remove any line containing hostnameOverride (simple safe approach)
            grep -v 'hostnameOverride' "$KUBELET_CONFIG" > "$TMP_KCFG"
            mv "$TMP_KCFG" "$KUBELET_CONFIG"
            chmod 600 "$KUBELET_CONFIG"
            CHANGED=1
            echo "  [INFO] Removed hostnameOverride from $KUBELET_CONFIG"
          else
            rm -f "$TMP_KCFG"
            echo "  [INFO] No hostnameOverride key found in $KUBELET_CONFIG"
          fi
        else
          echo "  [INFO] $KUBELET_CONFIG not found, skipping."
        fi

        # Restart kubelet only if something changed
        if [ "$CHANGED" -eq 1 ]; then
          echo "  [INFO] Reloading systemd and restarting kubelet (this will restart kubelet on this node)."
          systemctl daemon-reload
          systemctl restart kubelet.service
        else
          echo "  [INFO] No changes detected; kubelet restart not required."
        fi

        echo "  [VERIFY] Checking kubelet process flags for --hostname-override"
        if /bin/ps -fC kubelet | grep -q -- '--hostname-override'; then
          echo "  [FAIL] kubelet still running with --hostname-override:"
          /bin/ps -fC kubelet || true
          exit 1
        else
          echo "  [OK] kubelet is running without --hostname-override."
        fi

        EOF

          echo "=== Completed node: $NODE ==="
          echo
        }

        for NODE in "$@"; do
          fix_node "$NODE"
        done

        echo "All specified nodes processed."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kubelet/](https://kubernetes.io/docs/admin/kubelet/)