Skip to main content

Ensure Kubelet Configuration File Ownership Is Set Root

More Info:​

Ensure that the certificate authorities file ownership is set to root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS EKS
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check the current ownership of the kubelet configuration file:

    stat -c %U:%G /var/lib/kubelet/config.yaml

  2. On every worker node, set the ownership of the kubelet configuration file to root:root:

    sudo chown root:root /var/lib/kubelet/config.yaml

  3. On every worker node, re-verify the ownership matches root:root:

    /bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G /var/lib/kubelet/config.yaml; fi'
Using kubectl

kubectl cannot modify ownership or permissions of host-level files such as /var/lib/kubelet/config.yaml; this must be fixed directly on every worker node via the operating system. Refer to the Manual Steps section for the exact commands to run over SSH on each node.

Automation
#!/usr/bin/env bash
#
# Remediation: Ensure kubelet configuration file ownership is set to root:root
# Scope: Run on every worker node (and any control plane node that also runs kubelet)
# Safe to re-run (idempotent)

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"

echo "[-] Checking for kubelet config file at ${KUBELET_CONFIG}"

if ! [ -e "${KUBELET_CONFIG}" ]; then
  echo "[!] File not found: ${KUBELET_CONFIG}  (nothing to do on this node)"
  exit 0
fi

current_owner_group="$(stat -c '%U:%G' "${KUBELET_CONFIG}")"

echo "[-] Current ownership: ${KUBELET_CONFIG} -> ${current_owner_group}"

# Apply remediation only if needed
if [ "${current_owner_group}" != "root:root" ]; then
  echo "[-] Setting ownership to root:root on ${KUBELET_CONFIG}"
  chown root:root "${KUBELET_CONFIG}"
else
  echo "[-] Ownership already correct, no change required"
fi

# Verification step (mirrors the audit command)
verify_owner_group="$(stat -c '%U:%G' "${KUBELET_CONFIG}")"
echo "[-] Post-change ownership: ${KUBELET_CONFIG} -> ${verify_owner_group}"

if [ "${verify_owner_group}" != "root:root" ]; then
  echo "[ERROR] Failed to set ownership to root:root on ${KUBELET_CONFIG}"
  exit 1
fi

echo "[OK] Kubelet configuration file ownership is correctly set to root:root"

Additional Reading:​