STIGQter: STIG Summary: Kubernetes Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Apr 2026:

The Kubernetes kubelet staticPodPath must not enable static pods.

DISA Rule

SV-242397r1137638_rule

Vulnerability Number

V-242397

Group Title

SRG-APP-000033-CTR-000090

Rule Version

CNTR-K8-000440

Severity

CAT I

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

1. Remove staticPodPath setting on Kubernetes worker nodes:

a. On each Worker node, run the command:
ps -ef | grep kubelet

b. Note the path to the config file (identified by --config).

c. Edit the Kubernetes kubelet file in the --config directory on the Worker nodes. Remove the setting "staticPodPath".

d. Restart the kubelet service using the following command:
systemctl daemon-reload && systemctl restart kubelet

2. Remove Kubelet Systemd Service Arguments:

a. Modify the systemd Service File. Run the command:
sudo systemctl edit --full kubelet

(Example Return:ExecStart=/usr/bin/kubelet --pod-manifest-path=/etc/kubernetes/manifests)

b. Find and remove --pod-manifest-path.

c. Save and exit the editor.

d. Restart the kubelet service using the following command:
systemctl daemon-reload && systemctl restart kubelet

Check Contents

If staticPodPath is missing in the Kubelet config and in the systemd arguments, the node does not support static pods.

1. To find the staticPodPath setting on Kubernetes worker nodes, follow these steps:

a. On the Worker nodes, run the command:
ps -ef | grep kubelet

b. Note the path to the Kubelet configuration file (identified by --config).
(ls /var/lib/kubelet/config.yaml is the common location.)

c. Run the command:
grep -i staticPodPath <path_to_config_file>

If any of the Worker nodes return a value for "staticPodPath", this is a finding.

If staticPodPath is not in the config file, check if it is set as a command-line argument.

2. Check Kubelet Systemd Service Arguments.

a. Run the following command to check the Kubelet service:
sudo systemctl cat kubelet | grep pod-manifest-path

If there is no output, staticPodPath is not set in systemd arguments.

If there is any return, this is a finding.

(Example Return:ExecStart=/usr/bin/kubelet --pod-manifest-path=/etc/kubernetes/manifests
This means static pods are defined in /etc/kubernetes/manifests.)

Vulnerability Number

V-242397

Documentable

False

Rule Version

CNTR-K8-000440

Severity Override Guidance

If staticPodPath is missing in the Kubelet config and in the systemd arguments, the node does not support static pods.

1. To find the staticPodPath setting on Kubernetes worker nodes, follow these steps:

a. On the Worker nodes, run the command:
ps -ef | grep kubelet

b. Note the path to the Kubelet configuration file (identified by --config).
(ls /var/lib/kubelet/config.yaml is the common location.)

c. Run the command:
grep -i staticPodPath <path_to_config_file>

If any of the Worker nodes return a value for "staticPodPath", this is a finding.

If staticPodPath is not in the config file, check if it is set as a command-line argument.

2. Check Kubelet Systemd Service Arguments.

a. Run the following command to check the Kubelet service:
sudo systemctl cat kubelet | grep pod-manifest-path

If there is no output, staticPodPath is not set in systemd arguments.

If there is any return, this is a finding.

(Example Return:ExecStart=/usr/bin/kubelet --pod-manifest-path=/etc/kubernetes/manifests
This means static pods are defined in /etc/kubernetes/manifests.)

Check Content Reference

M

Target Key

5376