> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet Make IPTables Util Chains Set To True

### More Info:

The kubelet makeIPTablesUtilChains should be true so the kubelet manages iptables rules, ensuring correct network traffic handling on the node.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS AKS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Check current kubelet configuration source (each worker node)**
           ```bash theme={null}
           ps -fC kubelet
           ```
           * If you see `--config=/var/lib/kubelet/config.yaml`, it’s using the config file.
           * If you see `--make-iptables-util-chains=...` directly, it’s using command-line arguments.

        2. **If using kubelet config file: set `makeIPTablesUtilChains: true` (each worker node)**\
           Edit the file:
           ```bash theme={null}
           sudo vi /var/lib/kubelet/config.yaml
           ```
           Under the top-level config (same level as `kind:` and `apiVersion:`), ensure:
           ```yaml theme={null}
           makeIPTablesUtilChains: true
           ```
           Save and exit.

        3. **If using command-line flag: remove the explicit argument (each worker node)**\
           Edit the kubelet drop-in unit:
           ```bash theme={null}
           sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```
           In the line that contains `--make-iptables-util-chains=...`, remove only that argument (including the trailing space or line continuation), leaving the rest of the options unchanged. Save and exit.

        4. **Reload systemd and restart kubelet (each worker node)**\
           Restarting kubelet will briefly disrupt node-local workloads that depend on it.
           ```bash theme={null}
           sudo systemctl daemon-reload
           sudo systemctl restart kubelet.service
           ```

        5. **Verify kubelet is running with desired setting (each worker node)**
           ```bash theme={null}
           ps -fC kubelet
           ```
           * You should NOT see a `--make-iptables-util-chains=` flag in the output.
           * If using `/var/lib/kubelet/config.yaml`, confirm the file still contains `makeIPTablesUtilChains: true`:
             ```bash theme={null}
             grep -n 'makeIPTablesUtilChains' /var/lib/kubelet/config.yaml
             ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify kubelet host-level settings such as `makeIPTablesUtilChains` in `/var/lib/kubelet/config.yaml` or systemd unit files on worker nodes. Apply the remediation directly on each worker node as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix CIS AKS 3.2.6: Ensure kubelet makeIPTablesUtilChains is true
        # Target: run on every worker node (as root)
        #
        # Idempotent:
        # - Ensures makeIPTablesUtilChains: true in /var/lib/kubelet/config.yaml
        # - Removes any explicit --make-iptables-util-chains flag from kubelet systemd drop-ins
        # - Restarts kubelet if changes were made
        # - Verifies effective setting via kubelet config and process args

        set -euo pipefail

        KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
        SYSTEMD_DIR="/etc/systemd/system/kubelet.service.d"
        CHANGED=0

        echo "### [$(hostname)] Ensuring kubelet makeIPTablesUtilChains is true"

        if [[ ! -f "${KUBELET_CONFIG}" ]]; then
          echo "ERROR: ${KUBELET_CONFIG} not found. This script assumes a kubelet config file."
          exit 1
        fi

        # 1) Ensure makeIPTablesUtilChains: true in kubelet config
        echo "-> Updating ${KUBELET_CONFIG}"

        if grep -qE '^[[:space:]]*makeIPTablesUtilChains:' "${KUBELET_CONFIG}"; then
          # Replace existing key with true
          sed -i 's/^[[:space:]]*makeIPTablesUtilChains:.*/makeIPTablesUtilChains: true/' "${KUBELET_CONFIG}"
        else
          # Append at end of file (or you can adjust to insert under kubeletConfiguration as needed)
          printf '\nmakeIPTablesUtilChains: true\n' >> "${KUBELET_CONFIG}"
        fi

        CHANGED=1

        # 2) Remove explicit --make-iptables-util-chains from kubelet systemd drop-ins (if present)
        if [[ -d "${SYSTEMD_DIR}" ]]; then
          echo "-> Cleaning --make-iptables-util-chains from ${SYSTEMD_DIR}"

          while IFS= read -r -d '' unit_file; do
            if grep -q -- '--make-iptables-util-chains' "${unit_file}"; then
              # Remove the argument from the file
              sed -i 's/--make-iptables-util-chains[[:space:]]\+[a-zA-Z0-9_-]\+//g' "${unit_file}"
              sed -i 's/--make-iptables-util-chains[= ][a-zA-Z0-9_-]\+//g' "${unit_file}"
              CHANGED=1
            fi
          done < <(find "${SYSTEMD_DIR}" -maxdepth 1 -type f -name '*.conf' -print0)
        else
          echo "-> ${SYSTEMD_DIR} not present; skipping systemd drop-in cleanup"
        fi

        # 3) Restart kubelet only if something changed
        if [[ "${CHANGED}" -eq 1 ]]; then
          echo "-> Changes detected; restarting kubelet"
          systemctl daemon-reload
          systemctl restart kubelet.service
        else
          echo "-> No changes required; kubelet restart skipped"
        fi

        # 4) Verification
        echo "### Verification"

        echo "-> Checking kubelet config file for makeIPTablesUtilChains: true"
        if ! grep -qE '^[[:space:]]*makeIPTablesUtilChains:[[:space:]]*true[[:space:]]*$' "${KUBELET_CONFIG}"; then
          echo "VERIFICATION FAILED: ${KUBELET_CONFIG} does not contain 'makeIPTablesUtilChains: true'"
          exit 2
        fi
        echo "OK: ${KUBELET_CONFIG} has makeIPTablesUtilChains: true"

        echo "-> Checking running kubelet process arguments"
        /bin/ps -fC kubelet || {
          echo "VERIFICATION FAILED: kubelet process not found"
          exit 3
        }

        if /bin/ps -o args= -C kubelet | grep -q -- '--make-iptables-util-chains'; then
          echo "VERIFICATION WARNING: kubelet still has --make-iptables-util-chains flag set."
          echo "Ensure all kubelet systemd unit/drop-in files are updated and kubelet is restarted."
          exit 4
        else
          echo "OK: kubelet process has no explicit --make-iptables-util-chains flag (config file is authoritative)"
        fi

        echo "### Completed successfully on $(hostname)"
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>