> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet Hostname Override Argument Not Set

### More Info:

Overriding the hostname can interfere with TLS certificate validation and cloud provider node identification. Leaving --hostname-override unset preserves consistent node identity.

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, inspect the kubelet process arguments to confirm `--hostname-override` is in use:
           ```bash theme={null}
           /bin/ps -fC kubelet
           ```

        2. On every worker node, open the kubelet systemd drop-in file for editing:
           ```bash theme={null}
           sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```

        3. In that file, locate the line that defines extra kubelet arguments (for example `KUBELET_SYSTEM_PODS_ARGS=...` or an `ExecStart=` line) and remove the `--hostname-override=...` option entirely from the argument list. Save and exit.

        4. On every worker node, reload systemd configuration and restart the kubelet so the change takes effect:
           ```bash theme={null}
           sudo systemctl daemon-reload
           sudo systemctl restart kubelet.service
           ```

        5. If `/var/lib/kubelet/config.yaml` contains a `hostnameOverride:` field, remove that line as well and restart kubelet again:
           ```bash theme={null}
           sudo sed -i '/^[[:space:]]*hostnameOverride:/d' /var/lib/kubelet/config.yaml
           sudo systemctl restart kubelet.service
           ```

        6. Verification on every worker node: confirm the kubelet is running without `--hostname-override` in its arguments:
           ```bash theme={null}
           /bin/ps -fC kubelet | grep -- '--hostname-override' || echo "No --hostname-override argument set"
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change the kubelet’s `--hostname-override` setting because it is configured on each worker node’s host (via systemd units and kubelet config files), not through the Kubernetes API. To correct this finding, make the changes directly on the nodes as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix: Ensure kubelet --hostname-override argument is not set
        # Scope: every worker node (run on each worker via SSH, or via your config management)
        # Safe to re-run (idempotent).

        set -euo pipefail

        SERVICE_DIR="/etc/systemd/system/kubelet.service.d"
        SERVICE_FILE="${SERVICE_DIR}/10-kubeadm.conf"
        BACKUP_SUFFIX=".pre-hostname-override-fix.$(date +%Y%m%d%H%M%S)"

        echo "[INFO] Running on node: $(hostname -f || hostname)"

        # 1. Pre-flight checks
        if [[ ! -d "${SERVICE_DIR}" ]]; then
          echo "[ERROR] Directory ${SERVICE_DIR} not found; kubelet may be managed differently on this node."
          echo "[ERROR] This script cannot proceed safely. Review manually."
          exit 1
        fi

        if [[ ! -f "${SERVICE_FILE}" ]]; then
          echo "[ERROR] Kubelet service drop-in ${SERVICE_FILE} not found."
          echo "[ERROR] This script is tailored to kubeadm-based setups; review manually."
          exit 1
        fi

        # 2. Backup existing config (once per unique content)
        if ! grep -q "pre-hostname-override-fix" <<<"$(ls -1 ${SERVICE_DIR} 2>/dev/null || true)"; then
          cp -p "${SERVICE_FILE}" "${SERVICE_FILE}${BACKUP_SUFFIX}"
          echo "[INFO] Backup created at ${SERVICE_FILE}${BACKUP_SUFFIX}"
        else
          echo "[INFO] Backup appears to have been taken previously; skipping new backup."
        fi

        # 3. Remove --hostname-override from any KUBELET_SYSTEM_PODS_ARGS line
        #    - handles with/without value forms like:
        #      --hostname-override
        #      --hostname-override=foo
        #      --hostname-override foo
        TMP_FILE="$(mktemp)"
        trap 'rm -f "${TMP_FILE}"' EXIT

        changed=false

        while IFS= read -r line; do
          if [[ "${line}" =~ KUBELET_SYSTEM_PODS_ARGS ]]; then
            orig="${line}"

            # Remove patterns:
            #   --hostname-override
            #   --hostname-override=<value>
            #   --hostname-override <value>
            # Use multiple passes to keep sed expressions simpler and safe.
            line="$(printf '%s\n' "${line}" \
              | sed -E 's/[[:space:]]--hostname-override(=([^"[:space:]]+))?//g' \
              | sed -E 's/--hostname-override[[:space:]]+([^"[:space:]]+)//g')"

            # Normalize any double spaces introduced
            line="$(printf '%s\n' "${line}" | sed -E 's/[[:space:]]+/ /g')"

            # Preserve leading whitespace and quotes exactly; only spaces inside changed.
            # If the line changed, flag it.
            if [[ "${orig}" != "${line}" ]]; then
              changed=true
              echo "[INFO] Removed --hostname-override from KUBELET_SYSTEM_PODS_ARGS"
            fi
          fi
          printf '%s\n' "${line}" >> "${TMP_FILE}"
        done < "${SERVICE_FILE}"

        if [[ "${changed}" == false ]]; then
          echo "[INFO] No --hostname-override flag found in ${SERVICE_FILE}; nothing to change."
        else
          cp -p "${TMP_FILE}" "${SERVICE_FILE}"
          echo "[INFO] Updated ${SERVICE_FILE}"
        fi

        # 4. Reload systemd and restart kubelet if we changed anything
        if [[ "${changed}" == true ]]; then
          echo "[INFO] Reloading systemd daemon and restarting kubelet (this will restart kubelet)."
          systemctl daemon-reload
          systemctl restart kubelet.service
          echo "[INFO] kubelet restarted."
        fi

        # 5. Verification (matches benchmark audit: /bin/ps -fC kubelet)
        echo "[INFO] Verifying that kubelet is not running with --hostname-override..."

        if ! /bin/ps -fC kubelet >/dev/null 2>&1; then
          echo "[ERROR] kubelet process not found; verify kubelet service status."
          systemctl status kubelet.service || true
          exit 1
        fi

        if /bin/ps -fC kubelet | grep -q -- "--hostname-override"; then
          echo "[FAIL] kubelet is still running with --hostname-override:"
          /bin/ps -fC kubelet
          exit 1
        fi

        echo "[PASS] kubelet is running without --hostname-override."
        /bin/ps -fC kubelet
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>