Ensure that the --make-iptables-util-chains argument is set to true

MittelStufe 1Automatisiertaks

Beschreibung

The --make-iptables-util-chains setting ensures the kubelet creates the iptables utility hint chain used by other components to identify the node’s iptables configuration. This is important because it helps maintain predictable networking behavior on the worker node and supports components that rely on that hint to determine how iptables is configured on the host. Reads every node's effective kubelet configuration through the API server (kubectl get --raw /api/v1/nodes/<node>/proxy/configz); requires kubectl with nodes/proxy access. A missing makeIPTablesUtilChains means the default (true).

So wird geprüft

Prüfmethode: Shell-Befehl

shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { ! printf '%s' "$c" | grep -Eq '"makeIPTablesUtilChains":false'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Remediation note: In AKS, makeIPTablesUtilChains should be set to true. A blank result from a file or process-argument check is not automatically a finding, because Kubernetes defaults this setting to true and the value may not be written explicitly on the node. If the effective kubelet value is actually false, remediation should begin by validating the effective running configuration and then, if needed, use a Kubernetes-native node customization method rather than relying on ad hoc edits to individual worker nodes. • Verify the effective kubelet value first. Check the running kubelet configuration and confirm whether makeIPTablesUtilChains is actually true or false, because a blank file or process result may simply mean the kubelet is using its built-in default of true.

Eigenschaften

Betriebssysteme: Beliebig
Tags: aksworker-nodekubelet
Referenz: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 3.2.5 Ensure that the --make-iptables-util-chains argument is set to true

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target aks