Back to Checks
kubernetes

Kubelet configuration has makeIPTablesUtilChains set to true

kubelet_manage_iptables
Service: kubeletSeverity: medium
OfficialBuilt-inVerified
Categories:node-security
Resource Type:ConfigMap

Kubernetes Kubelet configured with makeIPTablesUtilChains manages iptables utility chains, keeping node firewall primitives aligned with dynamic pod networking. The setting is expected to be present and enabled in kubelet configuration.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without kubelet-managed iptables chains, nodes can drift to inconsistent firewall states, enabling:

  • Traffic drops and service outages (availability)
  • Unintended inter-pod exposure (confidentiality)
  • Conflicting rules altering expected flows (integrity)

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_manage_iptables

Recommendation

Enable kubelet management of iptables utility chains by setting makeIPTablesUtilChains=true.

Prefer automation over manual iptables edits to prevent drift. Combine with network policies, least privilege, and defense in depth to control east-west traffic. If your CNI replaces iptables, document the exception.

Remediation

Other

1SSH to each node running kubelet
2Edit the kubelet config file:
3- sudo vi /var/lib/kubelet/config.yaml
4In the KubeletConfiguration, set:
5- makeIPTablesUtilChains: true
6Save and restart kubelet:
7- sudo systemctl restart kubelet

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.kubelet.kubelet_client import kubelet_client


class kubelet_manage_iptables(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for cm in kubelet_client.kubelet_config_maps:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=cm)
            if "makeIPTablesUtilChains" not in cm.kubelet_args:
                report.status = "MANUAL"
                report.status_extended = f"Kubelet does not have the argument `makeIPTablesUtilChains` in config file {cm.name}, verify it in the node's arguments."
            else:
                if cm.kubelet_args["makeIPTablesUtilChains"]:
                    report.status = "PASS"
                    report.status_extended = f"Kubelet is configured to manage iptables in config file {cm.name}."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Kubelet is not configured to manage iptables in config file {cm.name}."
            findings.append(report)
        return findings

References