Kubelet Kubeconfig File Permissions Are 644 Or More

More Info:

The kubelet kubeconfig file should have permissions of 644 or more restrictive to prevent unauthorized users from reading or modifying kubelet credentials and cluster connection settings.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS EKS

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every worker node, check the current permissions and ownership of the kubelet kubeconfig file:

   stat -c 'file=%n permissions=%a owner=%U group=%G' /etc/kubernetes/kubelet.conf

2. On every worker node, set the permissions to 644 (owner read/write, group and others read-only):

   chmod 644 /etc/kubernetes/kubelet.conf

3. (Optional but recommended) On every worker node, ensure the file is owned by root and in the root group:

   chown root:root /etc/kubernetes/kubelet.conf

4. On every worker node, re-check the permissions to verify the fix:

   stat -c 'file=%n permissions=%a owner=%U group=%G' /etc/kubernetes/kubelet.conf

Using kubectl

kubectl cannot change file permissions on node-local paths such as /etc/kubernetes/kubelet.conf; this must be fixed directly on every worker node’s host OS. Use the steps in the Manual Steps section to adjust the permissions and verify the remediation.

Automation

#!/usr/bin/env bash
set -euo pipefail

# Automation for: Ensure Kubelet Kubeconfig File Permissions Are 644 Or More Restrictive
# Scope: run on every worker node (or from an admin host using SSH fan-out, see notes below)

KUBELET_KUBECONFIG="/etc/kubernetes/kubelet.conf"
DESIRED_MODE="644"
EXIT_CODE=0

echo "=== [$(hostname)] Checking kubelet kubeconfig permissions ==="

if [ ! -e "$KUBELET_KUBECONFIG" ]; then
  echo "File not found: $KUBELET_KUBECONFIG (nothing to change on this node)"
  exit 0
fi

# Show current state
CURRENT_MODE="$(stat -c '%a' "$KUBELET_KUBECONFIG")"
echo "Current mode on $KUBELET_KUBECONFIG: $CURRENT_MODE"

# Apply fix only if needed
if [ "$CURRENT_MODE" != "$DESIRED_MODE" ]; then
  echo "Setting permissions to $DESIRED_MODE on $KUBELET_KUBECONFIG"
  chmod "$DESIRED_MODE" "$KUBELET_KUBECONFIG"
else
  echo "Permissions already at $DESIRED_MODE; no change needed"
fi

# Verification (same logic as the audit command)
echo "Verifying permissions..."
VERIFY_OUTPUT="$(/bin/sh -c "if test -e $KUBELET_KUBECONFIG; then stat -c permissions=%a $KUBELET_KUBECONFIG; fi")"
echo "$VERIFY_OUTPUT"

if ! echo "$VERIFY_OUTPUT" | grep -q "permissions=$DESIRED_MODE"; then
  echo "ERROR: Expected permissions=$DESIRED_MODE but got: $VERIFY_OUTPUT" >&2
  EXIT_CODE=1
else
  echo "Success: kubelet kubeconfig file permissions are set to $DESIRED_MODE"
fi

exit "$EXIT_CODE"

Usage:

• On each worker node (as root or with sudo):

  sudo bash ./fix-kubelet-kubeconfig-perms.sh

• From an admin machine with SSH access to all worker nodes (example with a simple host list):

  # workers.txt contains one worker hostname or IP per line
  while read -r node; do
    echo "=== $node ==="
    ssh "root@$node" 'bash -s' < fix-kubelet-kubeconfig-perms.sh
  done < workers.txt