> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Hostname Override Argument Is Disabled

### More Info:

Do not override node hostnames.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check for a hostname override in the running kubelet process:
           ```bash theme={null}
           /bin/ps -fC kubelet | grep -- --hostname-override || echo "No hostname override in process args"
           ```

        2. On every worker node, edit the kubelet systemd drop-in to remove any `--hostname-override` flag from `KUBELET_SYSTEM_PODS_ARGS`:
           ```bash theme={null}
           sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```
           * In the `Environment="KUBELET_SYSTEM_PODS_ARGS=..."` line, delete `--hostname-override=...` (and any trailing spaces).
           * Save and exit.

        3. On every worker node, confirm that no `--hostname-override` remains in the drop-in:
           ```bash theme={null}
           grep -n "hostname-override" /etc/systemd/system/kubelet.service.d/10-kubeadm.conf || echo "No hostname-override in drop-in"
           ```

        4. On every worker node, reload systemd and restart kubelet (this will restart the kubelet and may briefly impact node status/workload scheduling):
           ```bash theme={null}
           sudo systemctl daemon-reload
           sudo systemctl restart kubelet.service
           ```

        5. On every worker node, if `/var/lib/kubelet/config.yaml` is used, ensure it does not specify a hostname override (field may be absent or empty, but must not be explicitly overriding):
           ```bash theme={null}
           sudo grep -n "hostnameOverride" /var/lib/kubelet/config.yaml || echo "No hostnameOverride field in kubelet config"
           ```

        6. On every worker node, verify that the running kubelet no longer has a hostname override argument:
           ```bash theme={null}
           /bin/ps -fC kubelet | grep -- --hostname-override && echo "STILL PRESENT - investigate" || echo "OK: no hostname-override in kubelet args"
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify kubelet process flags or host-level configuration files such as `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` or `/var/lib/kubelet/config.yaml`, so this finding cannot be fixed via the Kubernetes API. To remediate, make the change directly on each worker node as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Automates CIS Kubernetes 4.2.8 remediation:
        # Ensure kubelet is not started with --hostname-override on worker nodes.
        #
        # Usage:
        #   1) Put all worker node hostnames or IPs into /root/worker-nodes.txt, one per line.
        #   2) Ensure passwordless SSH and sudo (NOPASSWD) for the remote user.
        #   3) Run this script from an admin machine:
        #         chmod +x fix-kubelet-hostname-override.sh
        #         ./fix-kubelet-hostname-override.sh
        #
        # Re-runnable: yes (idempotent).
        #

        set -euo pipefail

        WORKER_LIST_FILE="/root/worker-nodes.txt"
        REMOTE_USER="root"

        if [[ ! -f "${WORKER_LIST_FILE}" ]]; then
          echo "Worker node list not found: ${WORKER_LIST_FILE}" >&2
          exit 1
        fi

        echo "Starting CIS 4.2.8 remediation on worker nodes from ${WORKER_LIST_FILE}"
        echo

        while IFS= read -r NODE; do
          [[ -z "${NODE}" ]] && continue
          echo "=== Processing worker node: ${NODE} ==="

          ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "${REMOTE_USER}@${NODE}" bash -s << 'EOF'
        set -euo pipefail

        SERVICE_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
        BACKUP_SUFFIX="$(date +%Y%m%d%H%M%S)"

        if [[ ! -f "${SERVICE_DROPIN}" ]]; then
          echo "  [WARN] kubelet drop-in not found at ${SERVICE_DROPIN}; skipping node."
          exit 0
        fi

        echo "  - Backing up ${SERVICE_DROPIN} to ${SERVICE_DROPIN}.${BACKUP_SUFFIX}.bak"
        cp -p "${SERVICE_DROPIN}" "${SERVICE_DROPIN}.${BACKUP_SUFFIX}.bak"

        ORIG_CONTENT="$(cat "${SERVICE_DROPIN}")"

        # Remove any occurrence of --hostname-override from the file, including in
        # KUBELET_SYSTEM_PODS_ARGS or other argument variables. Preserve rest of line.
        TMP_FILE="$(mktemp)"
        echo "${ORIG_CONTENT}" | \
          sed -E 's/--hostname-override(=[^[:space:]]*)?//g' | \
          sed -E 's/[[:space:]]+/ /g' > "${TMP_FILE}"

        if cmp -s "${SERVICE_DROPIN}" "${TMP_FILE}"; then
          echo "  - No --hostname-override argument found; no change needed."
          rm -f "${TMP_FILE}"
        else
          echo "  - Updating ${SERVICE_DROPIN} to remove --hostname-override"
          mv "${TMP_FILE}" "${SERVICE_DROPIN}"
          chown root:root "${SERVICE_DROPIN}"
          chmod 644 "${SERVICE_DROPIN}"

          echo "  - Reloading systemd and restarting kubelet (this will restart kubelet)"
          systemctl daemon-reload
          systemctl restart kubelet.service
        fi

        echo "  - Verifying kubelet process flags do not contain --hostname-override"
        /bin/ps -fC kubelet || { echo "    [ERROR] kubelet process not found after restart."; exit 1; }

        if /bin/ps -fC kubelet | grep -q -- "--hostname-override"; then
          echo "    [ERROR] kubelet still running with --hostname-override on this node."
          exit 1
        else
          echo "    [OK] kubelet is running without --hostname-override."
        fi

        EOF

          RC=$?
          if [[ ${RC} -ne 0 ]]; then
            echo "!!! Remediation FAILED on node ${NODE} (exit code ${RC})"
          else
            echo "--- Remediation SUCCESSFUL on node ${NODE}"
          fi
          echo

        done < "${WORKER_LIST_FILE}"

        echo "All nodes processed."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kubelet/](https://kubernetes.io/docs/admin/kubelet/)