0427-k8s-kubelet-iptable-chains - Allow Kubelet to Manage iptables Rules¶

Rule ID¶

• 0427-k8s-kubelet-iptable-chains

Category¶

• Container

Severity¶

• Info

Compatible Versions¶

• Linux

Description¶

• Protect tuned kernel parameters from being overwritten by Kubelet's default kernel parameter values.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Kubelets can automatically manage the required changes to iptables rules based on the network options you choose for your pods. It is recommended to let Kubelet handle iptables changes. This ensures that the table configuration stays synchronized with the pod network configuration. Custom configurations may be too restrictive or too permissive for iptables rules.

Risk Item¶

• Container Security

Audit Method¶

• Execute the following command to verify:

  ps -ef | grep kubelet
  

Remediation¶

• Kubelet can be started in two ways:
• Check if the configuration file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf exists. If the file exists, set the parameter --make-iptables-util-chains=true.
• If the file does not exist, Kubelet is started via command-line arguments. Check the Kubelet startup parameter -config, open the file, check if the parameter makeIPTablesUtilChains exists, and set it to true.

After configuration, restart Kubelet:

systemctl daemon-reload
systemctl restart kubelet.service

Impact¶

• Avoid conflicts with your custom iptables rules, and allow Kubernetes to manage the iptables rules.

Default Value¶

• By default: --make-iptables-util-chains=true

References¶

• kubelet

CIS Controls¶

• None