Host OS Footprint

Learning objectives

Find what is listening and what is installed on a node.
Remove a service and a package, and prove they are gone.
Explain why hand-hardening a node is the wrong production answer.

Linux kubelet

Find it before you remove it

A Kubernetes node should run the kubelet, a container runtime, a CNI agent and very little else. Every extra listening port and installed package is attack surface on a machine that holds every credential of every pod scheduled to it.

terminal

$ss -tlnp

$ps -p <PID> -o pid,user,cmd

$systemctl list-units --type=service --state=running

Remove, then prove

terminal

$kill <PID>

$ss -tlnp | grep 8099 || echo "port 8099 is closed"

port 8099 is closed

$apt-get remove -y telnet

$dpkg -l telnet | tail -3

Killing a process is not removing a service

If something is managed by systemd, killing the process gets you a fresh one seconds later. Check whether a unit owns it and use systemctl disable --now, then confirm with ss rather than assuming.

Nobody does this by hand in production

A hand-tuned node is a snowflake: nothing records what was changed, and the next node to scale up does not have the change. The production answer is a minimal, immutable node image such as Bottlerocket, Container-Optimized OS or a hardened AMI, which never had telnet on it, and which you replace wholesale rather than patch.

You kill a process listening on an unexpected port and it reappears a minute later. What did you miss?

Killing the process treats the symptom. systemctl disable --now stops it and prevents the restart, and only then does the port stay closed across a reboot.

Why is removing telnet from a running node a poor production fix, even though it is correct here?

Manual changes do not propagate and do not survive replacement. Fixing the image fixes every node that will ever exist, which is the difference between remediation and a one-off.

What makes a Kubernetes node a particularly valuable target compared with an ordinary server?

Compromising a node yields credentials for every workload on it, not just one. That is why the footprint argument is stronger here than for a general-purpose host.

Recap

Find listeners with ss -tlnp, identify what owns them, disable rather than kill, and confirm. The real fix is an immutable minimal image rather than a hand-tuned node. Next: the kernel parameters underneath.