Kubelet Configuration File Permissions Are 644 Or More

More Info:

The kubelet configuration file should have permissions of 644 or more restrictive to prevent unauthorized users from reading or tampering with the kubelets runtime configuration.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS EKS

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every worker node, check the current permissions of the kubelet configuration file:

   stat -c permissions=%a /var/lib/kubelet/config.yaml

2. On every worker node, set the file permissions to 644 as required:

   chmod 644 /var/lib/kubelet/config.yaml

3. (Optional, if you want to enforce ownership as well) On every worker node, ensure root owns the file:

   chown root:root /var/lib/kubelet/config.yaml

4. On every worker node, verify the permissions are now compliant:

   stat -c permissions=%a /var/lib/kubelet/config.yaml

   Confirm the output shows:

   permissions=644

Using kubectl

kubectl cannot change file permissions on kubelet config files such as /var/lib/kubelet/config.yaml, because this is host-level configuration on each worker node. To remediate this finding, you must adjust the file permissions directly on every worker node; see the Manual Steps section for the exact commands.

Automation

#!/usr/bin/env bash
#
# Purpose: Ensure kubelet configuration file permissions are 0644 or more restrictive
# Scope:   Run on every worker node (and any control-plane nodes that also run kubelet)
# Usage:   sudo /usr/local/sbin/fix-kubelet-config-perms.sh

set -euo pipefail

CONFIG_FILE="/var/lib/kubelet/config.yaml"
DESIRED_MODE="644"

echo "=== Kubelet config file permissions remediation ==="

# Check if the kubelet config file exists
if [ ! -e "$CONFIG_FILE" ]; then
  echo "INFO: $CONFIG_FILE does not exist on this node. Nothing to do."
  exit 0
fi

# Get current permissions (numeric)
CURRENT_MODE="$(stat -c '%a' "$CONFIG_FILE")"

echo "Current permissions on $CONFIG_FILE: $CURRENT_MODE"

# If current mode is already <= 644 (more restrictive), leave it as is
# Otherwise, set to 644.
# To compare numerically, strip leading zeros if present.
CURRENT_MODE_NUM=$((10#$CURRENT_MODE))
DESIRED_MODE_NUM=$((10#$DESIRED_MODE))

if [ "$CURRENT_MODE_NUM" -le "$DESIRED_MODE_NUM" ]; then
  echo "INFO: Permissions $CURRENT_MODE are already 0644 or more restrictive. No change needed."
else
  echo "INFO: Permissions $CURRENT_MODE are too permissive. Setting to $DESIRED_MODE."
  chmod "$DESIRED_MODE" "$CONFIG_FILE"
fi

# Verification (mirrors the audit command)
echo "=== Verification ==="
/bin/sh -c "if test -e $CONFIG_FILE; then stat -c permissions=%a $CONFIG_FILE; fi"

# Final check: ensure the resulting permissions are <= 644
FINAL_MODE="$(stat -c '%a' "$CONFIG_FILE")"
FINAL_MODE_NUM=$((10#$FINAL_MODE))

if [ "$FINAL_MODE_NUM" -le "$DESIRED_MODE_NUM" ]; then
  echo "SUCCESS: $CONFIG_FILE permissions are now $FINAL_MODE (644 or more restrictive)."
  exit 0
else
  echo "ERROR: Failed to set $CONFIG_FILE permissions to 644 or more restrictive. Current: $FINAL_MODE" >&2
  exit 1
fi