Skip to main content

Ensure Kubelet Kubeconfig File Ownership Is Set Root

More Info:​

Ensure that the kubelet.conf file ownership is set to root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS EKS
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, confirm the kubelet kubeconfig file exists and check its current ownership:

    ls -l /etc/kubernetes/kubelet.conf

  2. On every worker node, change ownership of the kubelet kubeconfig file to root:root:

    sudo chown root:root /etc/kubernetes/kubelet.conf

  3. (Optional, if permissions also need tightening) On every worker node, restrict permissions to read/write for root only:

    sudo chmod 600 /etc/kubernetes/kubelet.conf

  4. On every worker node, verify the ownership is now correct:

    stat -c %U:%G /etc/kubernetes/kubelet.conf

    The output must be:

    root:root
Using kubectl

kubectl cannot modify file ownership on worker node filesystems, including /etc/kubernetes/kubelet.conf. This finding must be fixed directly on each worker node via host-level commands; see the Manual Steps section for the exact steps and verification commands.

Automation
#!/usr/bin/env bash
#
# Fix CISEKS 3.1.2: Ensure Kubelet Kubeconfig File Ownership Is Set To root:root
# Target: run on every worker node (as root). Safe to re-run.

set -euo pipefail

KUBELET_KUBECONFIG="/etc/kubernetes/kubelet.conf"

echo "=== CISEKS 3.1.2 remediation on host: $(hostname) ==="

if [ ! -e "$KUBELET_KUBECONFIG" ]; then
  echo "File not found: $KUBELET_KUBECONFIG"
  echo "Nothing to change on this node."
  exit 0
fi

current_owner_group="$(stat -c '%U:%G' "$KUBELET_KUBECONFIG")"

if [ "$current_owner_group" = "root:root" ]; then
  echo "Ownership already correct: $KUBELET_KUBECONFIG -> $current_owner_group"
else
  echo "Current ownership: $KUBELET_KUBECONFIG -> $current_owner_group"
  echo "Setting ownership to root:root ..."
  chown root:root "$KUBELET_KUBECONFIG"
fi

echo "Verifying ownership..."
verified_owner_group="$(stat -c '%U:%G' "$KUBELET_KUBECONFIG")"
echo "Result: $KUBELET_KUBECONFIG -> $verified_owner_group"

if [ "$verified_owner_group" != "root:root" ]; then
  echo "ERROR: Failed to set ownership to root:root on $KUBELET_KUBECONFIG" >&2
  exit 1
fi

echo "Remediation successful on this node."

Additional Reading:​