Skip to main content

Ensure Hostname Override Argument Is Disabled

More Info:​

Do not override node hostnames.

Risk Level​

High

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check for a hostname override in the running kubelet process:

    /bin/ps -fC kubelet | grep -- --hostname-override || echo "No hostname override in process args"

  2. On every worker node, edit the kubelet systemd drop-in to remove any --hostname-override flag from KUBELET_SYSTEM_PODS_ARGS:

    sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
    • In the Environment="KUBELET_SYSTEM_PODS_ARGS=..." line, delete --hostname-override=... (and any trailing spaces).
    • Save and exit.

  3. On every worker node, confirm that no --hostname-override remains in the drop-in:

    grep -n "hostname-override" /etc/systemd/system/kubelet.service.d/10-kubeadm.conf || echo "No hostname-override in drop-in"

  4. On every worker node, reload systemd and restart kubelet (this will restart the kubelet and may briefly impact node status/workload scheduling):

    sudo systemctl daemon-reload
    sudo systemctl restart kubelet.service

  5. On every worker node, if /var/lib/kubelet/config.yaml is used, ensure it does not specify a hostname override (field may be absent or empty, but must not be explicitly overriding):

    sudo grep -n "hostnameOverride" /var/lib/kubelet/config.yaml || echo "No hostnameOverride field in kubelet config"

  6. On every worker node, verify that the running kubelet no longer has a hostname override argument:

    /bin/ps -fC kubelet | grep -- --hostname-override && echo "STILL PRESENT - investigate" || echo "OK: no hostname-override in kubelet args"
Using kubectl

kubectl cannot modify kubelet process flags or host-level configuration files such as /etc/systemd/system/kubelet.service.d/10-kubeadm.conf or /var/lib/kubelet/config.yaml, so this finding cannot be fixed via the Kubernetes API. To remediate, make the change directly on each worker node as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
#
# Automates CIS Kubernetes 4.2.8 remediation:
# Ensure kubelet is not started with --hostname-override on worker nodes.
#
# Usage:
#   1) Put all worker node hostnames or IPs into /root/worker-nodes.txt, one per line.
#   2) Ensure passwordless SSH and sudo (NOPASSWD) for the remote user.
#   3) Run this script from an admin machine:
#         chmod +x fix-kubelet-hostname-override.sh
#         ./fix-kubelet-hostname-override.sh
#
# Re-runnable: yes (idempotent).
#

set -euo pipefail

WORKER_LIST_FILE="/root/worker-nodes.txt"
REMOTE_USER="root"

if [[ ! -f "${WORKER_LIST_FILE}" ]]; then
  echo "Worker node list not found: ${WORKER_LIST_FILE}" >&2
  exit 1
fi

echo "Starting CIS 4.2.8 remediation on worker nodes from ${WORKER_LIST_FILE}"
echo

while IFS= read -r NODE; do
  [[ -z "${NODE}" ]] && continue
  echo "=== Processing worker node: ${NODE} ==="

  ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "${REMOTE_USER}@${NODE}" bash -s << 'EOF'
set -euo pipefail

SERVICE_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
BACKUP_SUFFIX="$(date +%Y%m%d%H%M%S)"

if [[ ! -f "${SERVICE_DROPIN}" ]]; then
  echo "  [WARN] kubelet drop-in not found at ${SERVICE_DROPIN}; skipping node."
  exit 0
fi

echo "  - Backing up ${SERVICE_DROPIN} to ${SERVICE_DROPIN}.${BACKUP_SUFFIX}.bak"
cp -p "${SERVICE_DROPIN}" "${SERVICE_DROPIN}.${BACKUP_SUFFIX}.bak"

ORIG_CONTENT="$(cat "${SERVICE_DROPIN}")"

# Remove any occurrence of --hostname-override from the file, including in
# KUBELET_SYSTEM_PODS_ARGS or other argument variables. Preserve rest of line.
TMP_FILE="$(mktemp)"
echo "${ORIG_CONTENT}" | \
  sed -E 's/--hostname-override(=[^[:space:]]*)?//g' | \
  sed -E 's/[[:space:]]+/ /g' > "${TMP_FILE}"

if cmp -s "${SERVICE_DROPIN}" "${TMP_FILE}"; then
  echo "  - No --hostname-override argument found; no change needed."
  rm -f "${TMP_FILE}"
else
  echo "  - Updating ${SERVICE_DROPIN} to remove --hostname-override"
  mv "${TMP_FILE}" "${SERVICE_DROPIN}"
  chown root:root "${SERVICE_DROPIN}"
  chmod 644 "${SERVICE_DROPIN}"

  echo "  - Reloading systemd and restarting kubelet (this will restart kubelet)"
  systemctl daemon-reload
  systemctl restart kubelet.service
fi

echo "  - Verifying kubelet process flags do not contain --hostname-override"
/bin/ps -fC kubelet || { echo "    [ERROR] kubelet process not found after restart."; exit 1; }

if /bin/ps -fC kubelet | grep -q -- "--hostname-override"; then
  echo "    [ERROR] kubelet still running with --hostname-override on this node."
  exit 1
else
  echo "    [OK] kubelet is running without --hostname-override."
fi

EOF

  RC=$?
  if [[ ${RC} -ne 0 ]]; then
    echo "!!! Remediation FAILED on node ${NODE} (exit code ${RC})"
  else
    echo "--- Remediation SUCCESSFUL on node ${NODE}"
  fi
  echo

done < "${WORKER_LIST_FILE}"

echo "All nodes processed."

Additional Reading:​