Kubelet Hostname Override Argument Not Set

More Info:

Overriding the hostname can interfere with TLS certificate validation and cloud provider node identification. Leaving --hostname-override unset preserves consistent node identity.

Risk Level

Low

Address

Security

Compliance Standards

• CIS Kubernetes

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every worker node, inspect the kubelet process arguments to confirm --hostname-override is in use:

   /bin/ps -fC kubelet

2. On every worker node, open the kubelet systemd drop-in file for editing:

   sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

3. In that file, locate the line that defines extra kubelet arguments (for example KUBELET_SYSTEM_PODS_ARGS=... or an ExecStart= line) and remove the --hostname-override=... option entirely from the argument list. Save and exit.

4. On every worker node, reload systemd configuration and restart the kubelet so the change takes effect:

   sudo systemctl daemon-reload
   sudo systemctl restart kubelet.service

5. If /var/lib/kubelet/config.yaml contains a hostnameOverride: field, remove that line as well and restart kubelet again:

   sudo sed -i '/^[[:space:]]*hostnameOverride:/d' /var/lib/kubelet/config.yaml
   sudo systemctl restart kubelet.service

6. Verification on every worker node: confirm the kubelet is running without --hostname-override in its arguments:

   /bin/ps -fC kubelet | grep -- '--hostname-override' || echo "No --hostname-override argument set"

Using kubectl

kubectl cannot change the kubelet’s --hostname-override setting because it is configured on each worker node’s host (via systemd units and kubelet config files), not through the Kubernetes API. To correct this finding, make the changes directly on the nodes as described in the Manual Steps section.

Automation

#!/usr/bin/env bash
#
# Fix: Ensure kubelet --hostname-override argument is not set
# Scope: every worker node (run on each worker via SSH, or via your config management)
# Safe to re-run (idempotent).

set -euo pipefail

SERVICE_DIR="/etc/systemd/system/kubelet.service.d"
SERVICE_FILE="${SERVICE_DIR}/10-kubeadm.conf"
BACKUP_SUFFIX=".pre-hostname-override-fix.$(date +%Y%m%d%H%M%S)"

echo "[INFO] Running on node: $(hostname -f || hostname)"

# 1. Pre-flight checks
if [[ ! -d "${SERVICE_DIR}" ]]; then
  echo "[ERROR] Directory ${SERVICE_DIR} not found; kubelet may be managed differently on this node."
  echo "[ERROR] This script cannot proceed safely. Review manually."
  exit 1
fi

if [[ ! -f "${SERVICE_FILE}" ]]; then
  echo "[ERROR] Kubelet service drop-in ${SERVICE_FILE} not found."
  echo "[ERROR] This script is tailored to kubeadm-based setups; review manually."
  exit 1
fi

# 2. Backup existing config (once per unique content)
if ! grep -q "pre-hostname-override-fix" <<<"$(ls -1 ${SERVICE_DIR} 2>/dev/null || true)"; then
  cp -p "${SERVICE_FILE}" "${SERVICE_FILE}${BACKUP_SUFFIX}"
  echo "[INFO] Backup created at ${SERVICE_FILE}${BACKUP_SUFFIX}"
else
  echo "[INFO] Backup appears to have been taken previously; skipping new backup."
fi

# 3. Remove --hostname-override from any KUBELET_SYSTEM_PODS_ARGS line
#    - handles with/without value forms like:
#      --hostname-override
#      --hostname-override=foo
#      --hostname-override foo
TMP_FILE="$(mktemp)"
trap 'rm -f "${TMP_FILE}"' EXIT

changed=false

while IFS= read -r line; do
  if [[ "${line}" =~ KUBELET_SYSTEM_PODS_ARGS ]]; then
    orig="${line}"

    # Remove patterns:
    #   --hostname-override
    #   --hostname-override=<value>
    #   --hostname-override <value>
    # Use multiple passes to keep sed expressions simpler and safe.
    line="$(printf '%s\n' "${line}" \
      | sed -E 's/[[:space:]]--hostname-override(=([^"[:space:]]+))?//g' \
      | sed -E 's/--hostname-override[[:space:]]+([^"[:space:]]+)//g')"

    # Normalize any double spaces introduced
    line="$(printf '%s\n' "${line}" | sed -E 's/[[:space:]]+/ /g')"

    # Preserve leading whitespace and quotes exactly; only spaces inside changed.
    # If the line changed, flag it.
    if [[ "${orig}" != "${line}" ]]; then
      changed=true
      echo "[INFO] Removed --hostname-override from KUBELET_SYSTEM_PODS_ARGS"
    fi
  fi
  printf '%s\n' "${line}" >> "${TMP_FILE}"
done < "${SERVICE_FILE}"

if [[ "${changed}" == false ]]; then
  echo "[INFO] No --hostname-override flag found in ${SERVICE_FILE}; nothing to change."
else
  cp -p "${TMP_FILE}" "${SERVICE_FILE}"
  echo "[INFO] Updated ${SERVICE_FILE}"
fi

# 4. Reload systemd and restart kubelet if we changed anything
if [[ "${changed}" == true ]]; then
  echo "[INFO] Reloading systemd daemon and restarting kubelet (this will restart kubelet)."
  systemctl daemon-reload
  systemctl restart kubelet.service
  echo "[INFO] kubelet restarted."
fi

# 5. Verification (matches benchmark audit: /bin/ps -fC kubelet)
echo "[INFO] Verifying that kubelet is not running with --hostname-override..."

if ! /bin/ps -fC kubelet >/dev/null 2>&1; then
  echo "[ERROR] kubelet process not found; verify kubelet service status."
  systemctl status kubelet.service || true
  exit 1
fi

if /bin/ps -fC kubelet | grep -q -- "--hostname-override"; then
  echo "[FAIL] kubelet is still running with --hostname-override:"
  /bin/ps -fC kubelet
  exit 1
fi

echo "[PASS] kubelet is running without --hostname-override."
/bin/ps -fC kubelet