Skip to main content

Kubelet Configuration File Should Have Permissions Set

More Info:​

Ensure that the certificate authorities file has permissions of 644 or more restrictive.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS EKS
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check the current permissions of the kubelet configuration file:

    stat -c permissions=%a /var/lib/kubelet/config.yaml

  2. On every worker node, set the kubelet configuration file permissions to 644:

    chmod 644 /var/lib/kubelet/config.yaml

  3. (Optional, if you want to restrict ownership as well) On every worker node, ensure the file is owned by root:

    chown root:root /var/lib/kubelet/config.yaml

  4. On every worker node, verify the permissions are now 644 or more restrictive:

    stat -c permissions=%a /var/lib/kubelet/config.yaml
Using kubectl

kubectl cannot change file permissions on worker node files such as /var/lib/kubelet/config.yaml; this must be fixed directly on each worker node’s host filesystem. Use the guidance in the Manual Steps section to update the permissions and verify the fix.

Automation
#!/usr/bin/env bash
#
# Purpose: Ensure kubelet config file permissions are set to 644 or more restrictive.
# Scope  : Run on every worker node (and any control-plane nodes that also run kubelet).
# Usage  : sudo /path/to/script.sh

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
DESIRED_MODE="644"
CHANGED=0

echo "==> Checking kubelet config permissions on this node"

if [ ! -e "${KUBELET_CONFIG}" ]; then
  echo "Kubelet config file not found at ${KUBELET_CONFIG}; nothing to change on this node."
else
  current_mode="$(stat -c '%a' "${KUBELET_CONFIG}")"
  echo "Current mode for ${KUBELET_CONFIG}: ${current_mode}"

  # Only relax permissions if needed; chmod is idempotent even if already 644
  if [ "${current_mode}" != "${DESIRED_MODE}" ]; then
    echo "Updating permissions to ${DESIRED_MODE} on ${KUBELET_CONFIG}"
    chmod "${DESIRED_MODE}" "${KUBELET_CONFIG}"
    CHANGED=1
  else
    echo "Permissions already set to ${DESIRED_MODE}; no change needed."
  fi
fi

echo
echo "==> Verifying result"

if [ -e "${KUBELET_CONFIG}" ]; then
  stat -c 'permissions=%a path=%n' "${KUBELET_CONFIG}"
else
  echo "Kubelet config file still not present at ${KUBELET_CONFIG}; verify kubelet configuration on this node."
fi

if [ "${CHANGED}" -eq 1 ]; then
  echo "Permissions were updated on this node."
else
  echo "No permission changes were required on this node."
fi

Additional Reading:​