> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubelet Configuration File Permissions Are 644 Or More Restrictive

### More Info:

The kubelet configuration file should have permissions of 644 or more restrictive to prevent unauthorized users from reading or tampering with the kubelets runtime configuration.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS EKS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check the current permissions of the kubelet configuration file:
           ```bash theme={null}
           stat -c permissions=%a /var/lib/kubelet/config.yaml
           ```

        2. On every worker node, set the file permissions to 644 as required:
           ```bash theme={null}
           chmod 644 /var/lib/kubelet/config.yaml
           ```

        3. (Optional, if you want to enforce ownership as well) On every worker node, ensure root owns the file:
           ```bash theme={null}
           chown root:root /var/lib/kubelet/config.yaml
           ```

        4. On every worker node, verify the permissions are now compliant:
           ```bash theme={null}
           stat -c permissions=%a /var/lib/kubelet/config.yaml
           ```
           Confirm the output shows:
           ```text theme={null}
           permissions=644
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change file permissions on kubelet config files such as `/var/lib/kubelet/config.yaml`, because this is host-level configuration on each worker node. To remediate this finding, you must adjust the file permissions directly on every worker node; see the Manual Steps section for the exact commands.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Purpose: Ensure kubelet configuration file permissions are 0644 or more restrictive
        # Scope:   Run on every worker node (and any control-plane nodes that also run kubelet)
        # Usage:   sudo /usr/local/sbin/fix-kubelet-config-perms.sh

        set -euo pipefail

        CONFIG_FILE="/var/lib/kubelet/config.yaml"
        DESIRED_MODE="644"

        echo "=== Kubelet config file permissions remediation ==="

        # Check if the kubelet config file exists
        if [ ! -e "$CONFIG_FILE" ]; then
          echo "INFO: $CONFIG_FILE does not exist on this node. Nothing to do."
          exit 0
        fi

        # Get current permissions (numeric)
        CURRENT_MODE="$(stat -c '%a' "$CONFIG_FILE")"

        echo "Current permissions on $CONFIG_FILE: $CURRENT_MODE"

        # If current mode is already <= 644 (more restrictive), leave it as is
        # Otherwise, set to 644.
        # To compare numerically, strip leading zeros if present.
        CURRENT_MODE_NUM=$((10#$CURRENT_MODE))
        DESIRED_MODE_NUM=$((10#$DESIRED_MODE))

        if [ "$CURRENT_MODE_NUM" -le "$DESIRED_MODE_NUM" ]; then
          echo "INFO: Permissions $CURRENT_MODE are already 0644 or more restrictive. No change needed."
        else
          echo "INFO: Permissions $CURRENT_MODE are too permissive. Setting to $DESIRED_MODE."
          chmod "$DESIRED_MODE" "$CONFIG_FILE"
        fi

        # Verification (mirrors the audit command)
        echo "=== Verification ==="
        /bin/sh -c "if test -e $CONFIG_FILE; then stat -c permissions=%a $CONFIG_FILE; fi"

        # Final check: ensure the resulting permissions are <= 644
        FINAL_MODE="$(stat -c '%a' "$CONFIG_FILE")"
        FINAL_MODE_NUM=$((10#$FINAL_MODE))

        if [ "$FINAL_MODE_NUM" -le "$DESIRED_MODE_NUM" ]; then
          echo "SUCCESS: $CONFIG_FILE permissions are now $FINAL_MODE (644 or more restrictive)."
          exit 0
        else
          echo "ERROR: Failed to set $CONFIG_FILE permissions to 644 or more restrictive. Current: $FINAL_MODE" >&2
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>