Kubelet Seccomp Default Parameter Set To True

Manual Steps

On every worker node, back up the current kubelet configuration file:

sudo cp -a /var/lib/kubelet/config.yaml /var/lib/kubelet/config.yaml.bak.$(date +%F-%H%M%S)

On every worker node, edit /var/lib/kubelet/config.yaml to enable the default seccomp profile. If the seccompDefault field exists, set it to true; if not, add it under apiVersion/kind/... at the top level of the KubeletConfiguration:
sudo sed -i 's/^seccompDefault:.*/seccompDefault: true/' /var/lib/kubelet/config.yaml || \ echo "seccompDefault: true" | sudo tee -a /var/lib/kubelet/config.yaml
Then open the file and confirm indentation and YAML validity:
sudo vi /var/lib/kubelet/config.yaml
Ensure there is a line like:
seccompDefault: true
On every worker node, ensure the kubelet is using the config file (adjust if your systemd unit differs). Inspect the kubelet systemd unit:
systemctl cat kubelet | sed -n '1,120p'
Confirm either --config=/var/lib/kubelet/config.yaml is present in ExecStart, or add it by editing the drop-in or unit file per your distribution’s guidance.
On every worker node, restart the kubelet to apply the change (this will disrupt pods on that node while they are rescheduled):
sudo systemctl daemon-reload sudo systemctl restart kubelet sudo systemctl status kubelet --no-pager
On every worker node, verify the kubelet process is running and pick out the node’s kubelet PID:
/bin/ps -fC kubelet
On every worker node, confirm that seccompDefault is now set to true in the active configuration by checking the live config file and ensuring the kubelet process is healthy:
grep -n 'seccompDefault' /var/lib/kubelet/config.yaml /bin/ps -fC kubelet

Using kubectl

kubectl cannot be used to enable seccompDefault for the kubelet because this setting is controlled entirely by host-level kubelet configuration and flags on every worker node (for example in /var/lib/kubelet/config.yaml or the kubelet systemd unit). To remediate this finding, follow the guidance in the Manual Steps section on each worker node.

Automation

#!/usr/bin/env bash
#
# Automation: Enable seccompDefault in /var/lib/kubelet/config.yaml on every worker node
#
# Usage (from an admin machine with SSH access to worker nodes as root or via sudo):
#   1) Put all worker node hostnames/IPs into /root/worker-nodes.txt (one per line)
#   2) Run:
#        bash enable-kubelet-seccomp-default.sh
#
# This script is idempotent and safe to re-run.

set -euo pipefail

WORKER_LIST_FILE="/root/worker-nodes.txt"
SSH_USER="root"           # change to your SSH user if needed
SSH_OPTS="-o BatchMode=yes -o StrictHostKeyChecking=accept-new"

if [[ ! -f "${WORKER_LIST_FILE}" ]]; then
  echo "Worker node list file not found: ${WORKER_LIST_FILE}" >&2
  exit 1
fi

echo "Reading worker nodes from ${WORKER_LIST_FILE}"
mapfile -t NODES < "${WORKER_LIST_FILE}"

if [[ "${#NODES[@]}" -eq 0 ]]; then
  echo "No nodes listed in ${WORKER_LIST_FILE}" >&2
  exit 1
fi

# Remote script to run on each worker node
read -r -d '' REMOTE_SCRIPT <<'EOF'
set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
SYSTEMD_UNIT="kubelet.service"

echo "=== $(hostname): processing kubelet config ==="

if [[ ! -f "${KUBELET_CONFIG}" ]]; then
  echo "ERROR: ${KUBELET_CONFIG} not found; kubelet may be configured differently on this node." >&2
  exit 1
fi

# Ensure the YAML has a top-level apiVersion to place seccompDefault under;
# do not alter structure otherwise.
# We'll append seccompDefault: true only if not already true.

CURRENT_SETTING="$(grep -E '^[[:space:]]*seccompDefault:' "${KUBELET_CONFIG}" 2>/dev/null || true)"

if [[ -n "${CURRENT_SETTING}" ]]; then
  # Normalize any existing line to 'seccompDefault: true'
  if echo "${CURRENT_SETTING}" | grep -q 'seccompDefault:[[:space:]]*true'; then
    echo "seccompDefault already set to true; no change needed."
  else
    echo "seccompDefault found but not true; updating to true."
    cp "${KUBELET_CONFIG}" "${KUBELET_CONFIG}.bak.$(date +%s)"
    # Replace any existing seccompDefault line with 'seccompDefault: true'
    # (preserves indentation)
    perl -pi -e 's/^(\s*seccompDefault:\s*).*/${1}true/' "${KUBELET_CONFIG}"
  fi
else
  echo "seccompDefault not present; adding seccompDefault: true at end of file."
  cp "${KUBELET_CONFIG}" "${KUBELET_CONFIG}.bak.$(date +%s)"
  printf "\nseccompDefault: true\n" >> "${KUBELET_CONFIG}"
fi

# Reload kubelet so the new config takes effect.
# Operational impact: this restarts kubelet, which can briefly impact node status.
if systemctl is-enabled --quiet "${SYSTEMD_UNIT}"; then
  echo "Restarting kubelet via systemd..."
  systemctl daemon-reload
  systemctl restart "${SYSTEMD_UNIT}"
else
  echo "WARNING: ${SYSTEMD_UNIT} not enabled under systemd; restart kubelet manually." >&2
fi

# Verification: confirm kubelet is running and seccompDefault is true in config
echo "Verifying kubelet process and seccompDefault setting..."

if ! /bin/ps -fC kubelet >/dev/null 2>&1; then
  echo "ERROR: kubelet process not found after restart." >&2
  exit 1
fi

if ! grep -Eq '^[[:space:]]*seccompDefault:[[:space:]]*true[[:space:]]*$' "${KUBELET_CONFIG}"; then
  echo "ERROR: seccompDefault: true not found in ${KUBELET_CONFIG} after modification." >&2
  exit 1
fi

echo "SUCCESS: kubelet running and seccompDefault: true configured."
EOF

for NODE in "${NODES[@]}"; do
  [[ -z "${NODE}" ]] && continue
  echo "===== Connecting to worker node: ${NODE} ====="
  ssh ${SSH_OPTS} "${SSH_USER}@${NODE}" "${REMOTE_SCRIPT}" || {
    echo "ERROR: remediation failed on node ${NODE}" >&2
  }
done

echo "=== Cluster-wide verification ==="
for NODE in "${NODES[@]}"; do
  [[ -z "${NODE}" ]] && continue
  echo "--- ${NODE} ---"
  ssh ${SSH_OPTS} "${SSH_USER}@${NODE}" "\
    echo 'ps output:' && /bin/ps -fC kubelet || echo 'kubelet not found'; \
    echo 'seccompDefault line:' && grep -E '^[[:space:]]*seccompDefault:' /var/lib/kubelet/config.yaml || echo 'seccompDefault not set'"
done

echo "Done."

Kubernetes

Kubernetes Misconfigurations

Kubelet Seccomp Default Parameter Set To True

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation