Kubelet Make IPTables Util Chains Set To True

More Info:

The kubelet makeIPTablesUtilChains should be true so the kubelet manages iptables rules, ensuring correct network traffic handling on the node.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS AKS

Triage and Remediation

Remediation

Remediation

Manual Steps

1. Check current kubelet configuration source (each worker node)

   ps -fC kubelet
   
   • If you see --config=/var/lib/kubelet/config.yaml, it’s using the config file.
   • If you see --make-iptables-util-chains=... directly, it’s using command-line arguments.

2. If using kubelet config file: set makeIPTablesUtilChains: true (each worker node)
   Edit the file:

   sudo vi /var/lib/kubelet/config.yaml
   

   Under the top-level config (same level as kind: and apiVersion:), ensure:

   makeIPTablesUtilChains: true
   

   Save and exit.

3. If using command-line flag: remove the explicit argument (each worker node)
   Edit the kubelet drop-in unit:

   sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
   

   In the line that contains --make-iptables-util-chains=..., remove only that argument (including the trailing space or line continuation), leaving the rest of the options unchanged. Save and exit.

4. Reload systemd and restart kubelet (each worker node)
   Restarting kubelet will briefly disrupt node-local workloads that depend on it.

   sudo systemctl daemon-reload
   sudo systemctl restart kubelet.service
   

5. Verify kubelet is running with desired setting (each worker node)

   ps -fC kubelet
   
   • You should NOT see a --make-iptables-util-chains= flag in the output.
   • If using /var/lib/kubelet/config.yaml, confirm the file still contains makeIPTablesUtilChains: true:
     grep -n 'makeIPTablesUtilChains' /var/lib/kubelet/config.yaml
     

Using kubectl

kubectl cannot modify kubelet host-level settings such as makeIPTablesUtilChains in /var/lib/kubelet/config.yaml or systemd unit files on worker nodes. Apply the remediation directly on each worker node as described in the Manual Steps section.

Automation

#!/usr/bin/env bash
#
# Fix CIS AKS 3.2.6: Ensure kubelet makeIPTablesUtilChains is true
# Target: run on every worker node (as root)
#
# Idempotent:
# - Ensures makeIPTablesUtilChains: true in /var/lib/kubelet/config.yaml
# - Removes any explicit --make-iptables-util-chains flag from kubelet systemd drop-ins
# - Restarts kubelet if changes were made
# - Verifies effective setting via kubelet config and process args

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
SYSTEMD_DIR="/etc/systemd/system/kubelet.service.d"
CHANGED=0

echo "### [$(hostname)] Ensuring kubelet makeIPTablesUtilChains is true"

if [[ ! -f "${KUBELET_CONFIG}" ]]; then
  echo "ERROR: ${KUBELET_CONFIG} not found. This script assumes a kubelet config file."
  exit 1
fi

# 1) Ensure makeIPTablesUtilChains: true in kubelet config
echo "-> Updating ${KUBELET_CONFIG}"

if grep -qE '^[[:space:]]*makeIPTablesUtilChains:' "${KUBELET_CONFIG}"; then
  # Replace existing key with true
  sed -i 's/^[[:space:]]*makeIPTablesUtilChains:.*/makeIPTablesUtilChains: true/' "${KUBELET_CONFIG}"
else
  # Append at end of file (or you can adjust to insert under kubeletConfiguration as needed)
  printf '\nmakeIPTablesUtilChains: true\n' >> "${KUBELET_CONFIG}"
fi

CHANGED=1

# 2) Remove explicit --make-iptables-util-chains from kubelet systemd drop-ins (if present)
if [[ -d "${SYSTEMD_DIR}" ]]; then
  echo "-> Cleaning --make-iptables-util-chains from ${SYSTEMD_DIR}"

  while IFS= read -r -d '' unit_file; do
    if grep -q -- '--make-iptables-util-chains' "${unit_file}"; then
      # Remove the argument from the file
      sed -i 's/--make-iptables-util-chains[[:space:]]\+[a-zA-Z0-9_-]\+//g' "${unit_file}"
      sed -i 's/--make-iptables-util-chains[= ][a-zA-Z0-9_-]\+//g' "${unit_file}"
      CHANGED=1
    fi
  done < <(find "${SYSTEMD_DIR}" -maxdepth 1 -type f -name '*.conf' -print0)
else
  echo "-> ${SYSTEMD_DIR} not present; skipping systemd drop-in cleanup"
fi

# 3) Restart kubelet only if something changed
if [[ "${CHANGED}" -eq 1 ]]; then
  echo "-> Changes detected; restarting kubelet"
  systemctl daemon-reload
  systemctl restart kubelet.service
else
  echo "-> No changes required; kubelet restart skipped"
fi

# 4) Verification
echo "### Verification"

echo "-> Checking kubelet config file for makeIPTablesUtilChains: true"
if ! grep -qE '^[[:space:]]*makeIPTablesUtilChains:[[:space:]]*true[[:space:]]*$' "${KUBELET_CONFIG}"; then
  echo "VERIFICATION FAILED: ${KUBELET_CONFIG} does not contain 'makeIPTablesUtilChains: true'"
  exit 2
fi
echo "OK: ${KUBELET_CONFIG} has makeIPTablesUtilChains: true"

echo "-> Checking running kubelet process arguments"
/bin/ps -fC kubelet || {
  echo "VERIFICATION FAILED: kubelet process not found"
  exit 3
}

if /bin/ps -o args= -C kubelet | grep -q -- '--make-iptables-util-chains'; then
  echo "VERIFICATION WARNING: kubelet still has --make-iptables-util-chains flag set."
  echo "Ensure all kubelet systemd unit/drop-in files are updated and kubelet is restarted."
  exit 4
else
  echo "OK: kubelet process has no explicit --make-iptables-util-chains flag (config file is authoritative)"
fi

echo "### Completed successfully on $(hostname)"