SV-242404r960960: Kubernetes Kubelet must deny hostname override. | Kubernetes STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Kubernetes Kubelet must deny hostname override.

Description

Discussion Text

Kubernetes allows for the overriding of hostnames. Allowing this feature to be implemented within the kubelets may break the TLS setup between the kubelet service and the API server. This setting also can make it difficult to associate logs with nodes if security analytics needs to take place. The better practice is to setup nodes with resolvable FQDNs and avoid overriding the hostnames.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001499

References

DPMS Target Kubernetes DISA DPMS Target Kubernetes 5376

Checks

DISA STIG (Manual Reference)

On the Control Plane and Worker nodes, run the command:
ps -ef | grep kubelet

If the option "--hostname-override" is present, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.kubernetes:def:242404
# Kubernetes Kubelet must deny hostname override.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# The configuration does not have the 'hostname-override' setting present.
# process58_object (process58_test)
test_1() {
  ps -eo args | grep -P '/usr/bin/kubelet\b.*--hostname-override\b' &>/dev/null
}

if test_1; then
  echo "PASS"
else
  echo "FAIL"
fi

Remediation

Run the command:  
systemctl status kubelet.  
Note the path to the drop-in file.

Determine the path to the environment file(s) with the command: 
grep -i EnvironmentFile <path_to_drop_in_file>.

Remove the "--hostname-override" option from any environment file where it is present.  

Restart the kubelet service using the following command:
systemctl daemon-reload && systemctl restart kubelet