> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet Make Iptables Util Chains Argument Set To True

### More Info:

When makeIPTablesUtilChains is true the kubelet manages iptables rules to ensure correct traffic handling for pods. Enabling it maintains expected network filtering behavior on the node.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Edit the kubelet config file to enable iptables util chains**
           * **Run on:** every worker node
           * Open the config file:
             ```bash theme={null}
             sudo vi /var/lib/kubelet/config.yaml
             ```
           * In the `kubeletConfiguration` section, add or modify this field so it reads exactly:
             ```yaml theme={null}
             makeIPTablesUtilChains: true
             ```
           * Save and exit.

        2. **(If present) Remove conflicting command-line flag from kubelet systemd drop-in**
           * **Run on:** every worker node
           * Open the kubelet drop-in file:
             ```bash theme={null}
             sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
             ```
           * In the `KUBELET_SYSTEM_PODS_ARGS` (or any `KUBELET_*` variable), remove any occurrence of:
             ```text theme={null}
             --make-iptables-util-chains=false
             --make-iptables-util-chains=true
             ```
           * Save and exit.

        3. **Reload systemd units**
           * **Run on:** every worker node
           ```bash theme={null}
           sudo systemctl daemon-reload
           ```

        4. **Restart kubelet to apply changes**
           * **Run on:** every worker node
           ```bash theme={null}
           sudo systemctl restart kubelet.service
           ```

        5. **Verify kubelet is running**
           * **Run on:** every worker node
           ```bash theme={null}
           sudo systemctl status kubelet.service --no-pager
           ```

        6. **Verify the kubelet now has makeIPTablesUtilChains enabled**
           * **Run on:** every worker node
           ```bash theme={null}
           /bin/ps -fC kubelet
           grep -E 'makeIPTablesUtilChains: true' /var/lib/kubelet/config.yaml
           ```
           * Confirm there is **no** `--make-iptables-util-chains` flag in the `ps` output, and the config file shows `makeIPTablesUtilChains: true`.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify kubelet host-level configuration such as `/var/lib/kubelet/config.yaml` or systemd unit files on worker nodes. To remediate this finding, you must change the kubelet config and/or systemd unit directly on every worker node; follow the guidance in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Purpose: Ensure kubelet has makeIPTablesUtilChains=true via config file
        # Scope:   Run on every WORKER NODE (not control plane) as root
        # Safe:    Idempotent; can be re-run

        set -euo pipefail

        KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
        SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
        BACKUP_SUFFIX="$(date +%Y%m%d%H%M%S)"

        echo "==> Ensuring kubelet uses makeIPTablesUtilChains=true via config file on worker node"

        if [[ ! -f "${KUBELET_CONFIG}" ]]; then
          echo "ERROR: ${KUBELET_CONFIG} not found. This script expects kubelet to use a config file."
          exit 1
        fi

        # 1) Backup kubelet config once per run
        cp -n "${KUBELET_CONFIG}" "${KUBELET_CONFIG}.bak.${BACKUP_SUFFIX}" || true

        # 2) Ensure makeIPTablesUtilChains: true exists and is correctly set in the config file
        #    - If key exists: force to true
        #    - If key missing: append under top-level (simple YAML edit)

        if grep -qE '^[[:space:]]*makeIPTablesUtilChains:' "${KUBELET_CONFIG}"; then
          # Replace any existing value with true
          sed -i 's/^[[:space:]]*makeIPTablesUtilChains:.*/makeIPTablesUtilChains: true/' "${KUBELET_CONFIG}"
        else
          # Append at end as a top-level key
          printf '\nmakeIPTablesUtilChains: true\n' >> "${KUBELET_CONFIG}"
        fi

        # 3) If kubelet is using command-line flags, remove explicit --make-iptables-util-chains=
        #    from the kubelet systemd drop-in to avoid conflicting with config file
        if [[ -f "${SYSTEMD_DROPIN}" ]]; then
          cp -n "${SYSTEMD_DROPIN}" "${SYSTEMD_DROPIN}.bak.${BACKUP_SUFFIX}" || true

          # Remove any --make-iptables-util-chains=... occurrences from lines
          sed -i 's/\s\+--make-iptables-util-chains=[^[:space:]]\+//g' "${SYSTEMD_DROPIN}"
        fi

        # 4) Reload systemd and restart kubelet (this will briefly disrupt workloads on this node)
        echo "==> Restarting kubelet (this restarts the kubelet process)..."
        systemctl daemon-reload
        systemctl restart kubelet.service

        # 5) Verification: confirm kubelet is running and uses makeIPTablesUtilChains=true
        echo "==> Verifying kubelet process and configuration..."

        # Check process exists
        if ! /bin/ps -fC kubelet >/dev/null 2>&1; then
          echo "ERROR: kubelet process not found after restart."
          exit 1
        fi

        # Verify config file has the correct setting
        if ! grep -qE '^[[:space:]]*makeIPTablesUtilChains:[[:space:]]*true[[:space:]]*$' "${KUBELET_CONFIG}"; then
          echo "ERROR: ${KUBELET_CONFIG} does not contain 'makeIPTablesUtilChains: true' after update."
          exit 1
        fi

        echo "SUCCESS: kubelet is running and ${KUBELET_CONFIG} has makeIPTablesUtilChains: true"
        echo "You can also re-run: /bin/ps -fC kubelet"
        ```

        Usage:

        * Copy this script to each worker node as root, e.g. `/root/fix-kubelet-iptables.sh`.
        * Run on every worker node:

        ```bash theme={null}
        chmod +x /root/fix-kubelet-iptables-iptables.sh
        /root/fix-kubelet-iptables-iptables.sh
        ```

        Final verification on each worker node:

        ```bash theme={null}
        /bin/ps -fC kubelet
        grep -n 'makeIPTablesUtilChains' /var/lib/kubelet/config.yaml
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>