0426-k8s-protect-kernel-Ensure protect-kernel-defaults is set to true¶

Rule ID¶

0426-k8s-protect-kernel

Category¶

container

Level¶

info

Compatible Versions¶

Linux

Description¶

Protect tuned kernel parameters from being overwritten by kubelet default kernel parameter values.

Scan Frequency¶

0 */30 * * *

Rationale¶

Kernel parameters are typically tuned and hardened by system administrators before the system is put into production. These parameters protect the entire kernel and system. The kubelet kernel defaults that depend on these parameters should be set appropriately to match the desired security state of the system. Ignoring this could result in running pods with unwanted kernel behavior.

Risk Item¶

Container Security

Audit Method¶

Execute the following command to verify:
```
ps -ef | grep kubelet
```

Remediation¶

The kubelet can be started in two ways:

Check if a configuration file exists: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf. If the file exists, add the parameter --protect-kernel-defaults=true.

If the file does not exist, the kubelet is started via command line arguments. Check the kubelet startup parameter -config, open the file, verify that the protectKernelDefaults parameter exists and is set to true.

After setting, restart the kubelet:

systemctl daemon-reload
systemctl restart kubelet.service

Impact¶

You must re-adjust kernel parameters to match the kubelet parameters.

Default Value¶

By default, protect-kernel-defaults=true

References¶

kubelet

CIS Controls¶

None