Skip to main content

Ensure Kubelet Kubeconfig File Ownership Is Set To root:root

More Info:​

The kubelet kubeconfig file ownership should be set to root:root so that only the root user can read or modify the kubelet credentials and cluster connection settings.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS EKS

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, confirm the kubelet kubeconfig file exists:

    sudo ls -l /etc/kubernetes/kubelet.conf

  2. On every worker node, set the ownership of the kubelet kubeconfig file to root:root:

    sudo chown root:root /etc/kubernetes/kubelet.conf

  3. On every worker node, verify the ownership is correctly set (passes when output is root:root):

    stat -c %U:%G /etc/kubernetes/kubelet.conf
Using kubectl

kubectl cannot modify file ownership on the worker node filesystem where /etc/kubernetes/kubelet.conf resides; this must be fixed directly on every worker node via host-level commands. Refer to the Manual Steps section for the SSH-based procedure to change ownership and verify the fix.

Automation
#!/usr/bin/env bash
#
# Automation: Ensure Kubelet kubeconfig file ownership is set to root:root
# Scope: Run on every worker node (as root). Safe to re-run.

set -euo pipefail

KUBELET_KUBECONFIG="/etc/kubernetes/kubelet.conf"

echo "==> Checking for kubelet kubeconfig at ${KUBELET_KUBECONFIG}"

if [ ! -e "${KUBELET_KUBECONFIG}" ]; then
  echo "Kubelet kubeconfig not found at ${KUBELET_KUBECONFIG}, nothing to change on this node."
  exit 0
fi

current_owner="$(stat -c '%U:%G' "${KUBELET_KUBECONFIG}")"

echo "Current ownership: ${current_owner}"

if [ "${current_owner}" != "root:root" ]; then
  echo "Changing ownership to root:root ..."
  chown root:root "${KUBELET_KUBECONFIG}"
else
  echo "Ownership already set to root:root, no change needed."
fi

echo "==> Verifying ownership"

verify_owner="$(stat -c '%U:%G' "${KUBELET_KUBECONFIG}")"
echo "Verified ownership: ${verify_owner}"

if [ "${verify_owner}" != "root:root" ]; then
  echo "ERROR: Failed to set ownership to root:root on ${KUBELET_KUBECONFIG}" >&2
  exit 1
fi

echo "SUCCESS: ${KUBELET_KUBECONFIG} ownership is root:root"