STIGQter: STIG Summary: Kubernetes Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Apr 2026:

Kubernetes Kubelet must enable kernel protection.

DISA Rule

SV-242434r961131_rule

Vulnerability Number

V-242434

Group Title

SRG-APP-000233-CTR-000585

Rule Version

CNTR-K8-001620

Severity

CAT I

CCI(s)

• CCI-001084 - Isolate security functions from nonsecurity functions.

Weight

10

Fix Recommendation

On the Control Plane, run the command:
ps -ef | grep kubelet

Remove the "--protect-kernel-defaults" option if present.

Note the path to the Kubernetes Kubelet config file (identified by --config).

Edit the Kubernetes Kubelet config file:
Set "protectKernelDefaults" to "true".

Restart the kubelet service using the following command:
systemctl daemon-reload && systemctl restart kubelet

Check Contents

On the Control Plane, run the command:
ps -ef | grep kubelet

If the "--protect-kernel-defaults" option exists, this is a finding.

Note the path to the config file (identified by --config).

Run the command:
grep -i protectKernelDefaults <path_to_config_file>

If the setting "protectKernelDefaults" is not set or is set to false, this is a finding.

Vulnerability Number

V-242434

Documentable

False

Rule Version

CNTR-K8-001620

Severity Override Guidance

On the Control Plane, run the command:
ps -ef | grep kubelet

If the "--protect-kernel-defaults" option exists, this is a finding.

Note the path to the config file (identified by --config).

Run the command:
grep -i protectKernelDefaults <path_to_config_file>

If the setting "protectKernelDefaults" is not set or is set to false, this is a finding.

Check Content Reference

M

Target Key

5376