Skip to main content

Kubelet Make Iptables Util Chains Argument Set To True

More Info:​

When makeIPTablesUtilChains is true the kubelet manages iptables rules to ensure correct traffic handling for pods. Enabling it maintains expected network filtering behavior on the node.

Risk Level​

High

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. Edit the kubelet config file to enable iptables util chains

    • Run on: every worker node
    • Open the config file: 
      sudo vi /var/lib/kubelet/config.yaml
    • In the kubeletConfiguration section, add or modify this field so it reads exactly: 
      makeIPTablesUtilChains: true
    • Save and exit.

  2. (If present) Remove conflicting command-line flag from kubelet systemd drop-in

    • Run on: every worker node
    • Open the kubelet drop-in file: 
      sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
    • In the KUBELET_SYSTEM_PODS_ARGS (or any KUBELET_* variable), remove any occurrence of: 
      --make-iptables-util-chains=false
      --make-iptables-util-chains=true
    • Save and exit.

  3. Reload systemd units

    • Run on: every worker node
    sudo systemctl daemon-reload

  4. Restart kubelet to apply changes

    • Run on: every worker node
    sudo systemctl restart kubelet.service

  5. Verify kubelet is running

    • Run on: every worker node
    sudo systemctl status kubelet.service --no-pager

  6. Verify the kubelet now has makeIPTablesUtilChains enabled

    • Run on: every worker node
    /bin/ps -fC kubelet
    grep -E 'makeIPTablesUtilChains: true' /var/lib/kubelet/config.yaml
    • Confirm there is no --make-iptables-util-chains flag in the ps output, and the config file shows makeIPTablesUtilChains: true.
Using kubectl

kubectl cannot modify kubelet host-level configuration such as /var/lib/kubelet/config.yaml or systemd unit files on worker nodes. To remediate this finding, you must change the kubelet config and/or systemd unit directly on every worker node; follow the guidance in the Manual Steps section.

Automation
#!/usr/bin/env bash
# Purpose: Ensure kubelet has makeIPTablesUtilChains=true via config file
# Scope:   Run on every WORKER NODE (not control plane) as root
# Safe:    Idempotent; can be re-run

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
BACKUP_SUFFIX="$(date +%Y%m%d%H%M%S)"

echo "==> Ensuring kubelet uses makeIPTablesUtilChains=true via config file on worker node"

if [[ ! -f "${KUBELET_CONFIG}" ]]; then
  echo "ERROR: ${KUBELET_CONFIG} not found. This script expects kubelet to use a config file."
  exit 1
fi

# 1) Backup kubelet config once per run
cp -n "${KUBELET_CONFIG}" "${KUBELET_CONFIG}.bak.${BACKUP_SUFFIX}" || true

# 2) Ensure makeIPTablesUtilChains: true exists and is correctly set in the config file
#    - If key exists: force to true
#    - If key missing: append under top-level (simple YAML edit)

if grep -qE '^[[:space:]]*makeIPTablesUtilChains:' "${KUBELET_CONFIG}"; then
  # Replace any existing value with true
  sed -i 's/^[[:space:]]*makeIPTablesUtilChains:.*/makeIPTablesUtilChains: true/' "${KUBELET_CONFIG}"
else
  # Append at end as a top-level key
  printf '\nmakeIPTablesUtilChains: true\n' >> "${KUBELET_CONFIG}"
fi

# 3) If kubelet is using command-line flags, remove explicit --make-iptables-util-chains=
#    from the kubelet systemd drop-in to avoid conflicting with config file
if [[ -f "${SYSTEMD_DROPIN}" ]]; then
  cp -n "${SYSTEMD_DROPIN}" "${SYSTEMD_DROPIN}.bak.${BACKUP_SUFFIX}" || true

  # Remove any --make-iptables-util-chains=... occurrences from lines
  sed -i 's/\s\+--make-iptables-util-chains=[^[:space:]]\+//g' "${SYSTEMD_DROPIN}"
fi

# 4) Reload systemd and restart kubelet (this will briefly disrupt workloads on this node)
echo "==> Restarting kubelet (this restarts the kubelet process)..."
systemctl daemon-reload
systemctl restart kubelet.service

# 5) Verification: confirm kubelet is running and uses makeIPTablesUtilChains=true
echo "==> Verifying kubelet process and configuration..."

# Check process exists
if ! /bin/ps -fC kubelet >/dev/null 2>&1; then
  echo "ERROR: kubelet process not found after restart."
  exit 1
fi

# Verify config file has the correct setting
if ! grep -qE '^[[:space:]]*makeIPTablesUtilChains:[[:space:]]*true[[:space:]]*$' "${KUBELET_CONFIG}"; then
  echo "ERROR: ${KUBELET_CONFIG} does not contain 'makeIPTablesUtilChains: true' after update."
  exit 1
fi

echo "SUCCESS: kubelet is running and ${KUBELET_CONFIG} has makeIPTablesUtilChains: true"
echo "You can also re-run: /bin/ps -fC kubelet"

Usage:

  • Copy this script to each worker node as root, e.g. /root/fix-kubelet-iptables.sh.
  • Run on every worker node:
chmod +x /root/fix-kubelet-iptables-iptables.sh
/root/fix-kubelet-iptables-iptables.sh

Final verification on each worker node:

/bin/ps -fC kubelet
grep -n 'makeIPTablesUtilChains' /var/lib/kubelet/config.yaml