More Info:
Do not override node hostnames.Risk Level
HighAddress
SecurityCompliance Standards
- APRA CPS 234 (Australia)
- BSI C5 (Germany)
- Brazil LGPD
- CCPA / CPRA (California)
- CIS Critical Security Controls v8
- CIS GKE
- CMMC 2.0
- CSA Cloud Controls Matrix v4
- DPDPA
- Digital Operational Resilience Act (EU)
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- KSA PDPL
- MAS Technology Risk Management (Singapore)
- MITRE ATT&CK (Cloud)
- NIST SP 800-171
- NYDFS 23 NYCRR 500
- SWIFT Customer Security Controls Framework
- Sarbanes-Oxley IT General Controls
- UK NCSC Cyber Assessment Framework
Triage and Remediation
- Remediation
Remediation
Manual Steps
Manual Steps
-
On every worker node, inspect the current kubelet process to confirm
--hostname-overrideis in use:Look for--hostname-override=in the command line. -
On every worker node, open the kubelet systemd drop-in file for editing:
-
In that file, locate the line that defines extra kubelet args (commonly
Environment="KUBELET_SYSTEM_PODS_ARGS=..."or similar) and remove the--hostname-override=...argument from the value. Save and exit the editor. -
On every worker node, reload systemd and restart kubelet to apply the change:
-
(If
/var/lib/kubelet/config.yamlalso contains a hostname override) On every worker node, edit the kubelet configuration file:Remove any line that setshostnameOverride:and save the file, then restart kubelet again: -
Verify on every worker node that kubelet is now running without
--hostname-override:Confirm that--hostname-overrideno longer appears in the kubelet process arguments.
Using kubectl
Using kubectl
kubectl cannot change the kubelet startup arguments or the host-level configuration at
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf or /var/lib/kubelet/config.yaml. To remove the --hostname-override flag, you must edit the kubelet service configuration directly on each worker node; follow the guidance in the Manual Steps section.Automation
Automation

