Skip to main content

More Info:

Do not override node hostnames.

Risk Level

High

Address

Security

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS GKE
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Manual Steps

  1. On every worker node, inspect the current kubelet process to confirm --hostname-override is in use:
    Look for --hostname-override= in the command line.
  2. On every worker node, open the kubelet systemd drop-in file for editing:
  3. In that file, locate the line that defines extra kubelet args (commonly Environment="KUBELET_SYSTEM_PODS_ARGS=..." or similar) and remove the --hostname-override=... argument from the value. Save and exit the editor.
  4. On every worker node, reload systemd and restart kubelet to apply the change:
  5. (If /var/lib/kubelet/config.yaml also contains a hostname override) On every worker node, edit the kubelet configuration file:
    Remove any line that sets hostnameOverride: and save the file, then restart kubelet again:
  6. Verify on every worker node that kubelet is now running without --hostname-override:
    Confirm that --hostname-override no longer appears in the kubelet process arguments.
kubectl cannot change the kubelet startup arguments or the host-level configuration at /etc/systemd/system/kubelet.service.d/10-kubeadm.conf or /var/lib/kubelet/config.yaml. To remove the --hostname-override flag, you must edit the kubelet service configuration directly on each worker node; follow the guidance in the Manual Steps section.

Additional Reading: