Kubelet configuration has makeIPTablesUtilChains set to true

​

What this check verifies

Kubernetes Kubelet configured with makeIPTablesUtilChains manages iptables utility chains, keeping node firewall primitives aligned with dynamic pod networking. The setting is expected to be present and enabled in kubelet configuration.

​

Risk

Without kubelet-managed iptables chains, nodes can drift to inconsistent firewall states, enabling:

• Traffic drops and service outages (availability)
• Unintended inter-pod exposure (confidentiality)
• Conflicting rules altering expected flows (integrity)

​

Recommendation

Enable kubelet management of iptables utility chains by setting makeIPTablesUtilChains=true. Prefer automation over manual iptables edits to prevent drift. Combine with network policies, least privilege, and defense in depth to control east-west traffic. If your CNI replaces iptables, document the exception.

​

Remediation

Dashboard steps

1. SSH to each node running kubelet
2. Edit the kubelet config file:
   • sudo vi /var/lib/kubelet/config.yaml
3. In the KubeletConfiguration, set:
   • makeIPTablesUtilChains: true
4. Save and restart kubelet:
   • sudo systemctl restart kubelet

​

References

• https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_manage_iptables. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks