Ensure the kubelet iptables utility chains are enabled

Trung bìnhCấp 1Tự độngeks

Mô tả

This control is intended to keep kubelet-managed iptables support enabled on worker nodes so the node maintains the expected networking behavior for Kubernetes traffic handling. The recommended state is makeIPTablesUtilChains: true, and in EKS this should be enforced through the node’s managed bootstrap and launch configuration, because AWS applies deeper node customization through launch templates and merged user data. Reads every node's effective kubelet configuration through the API server (kubectl get --raw /api/v1/nodes/<node>/proxy/configz); requires kubectl with nodes/proxy access.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { ! printf '%s' "$c" | grep -Eq '"makeIPTablesUtilChains":false'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

If the audit returns false, the worker node is not keeping kubelet iptables utility chains enabled and should be treated as noncompliant. If the result is null or the field is missing, first confirm the configz response is complete, because Kubernetes identifies that endpoint as the view of the kubelet’s final actuated configuration, and the kubelet configuration schema defines makeIPTablesUtilChains with a default of true. Once the result is validated, remediation in EKS should be performed through the supported node provisioning or node update workflow, not by directly editing the kubelet config file on the host. AWS documents that managed node customization is applied through launch templates and bootstrap logic, and that managed node group updates to a new launch template version replace the nodes to match that configuration.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: eksworker-nodekubelet
Tham chiếu: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 3.2.5 Ensure the kubelet iptables utility chains are enabled

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target eks