> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubelet Kubeconfig File Permissions Are 644 Or More Restrictive

### More Info:

The kubelet kubeconfig file should have permissions of 644 or more restrictive to prevent unauthorized users from reading or modifying kubelet credentials and cluster connection settings.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS EKS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check the current permissions and ownership of the kubelet kubeconfig file:
           ```bash theme={null}
           stat -c 'file=%n permissions=%a owner=%U group=%G' /etc/kubernetes/kubelet.conf
           ```

        2. On every worker node, set the permissions to 644 (owner read/write, group and others read-only):
           ```bash theme={null}
           chmod 644 /etc/kubernetes/kubelet.conf
           ```

        3. (Optional but recommended) On every worker node, ensure the file is owned by root and in the root group:
           ```bash theme={null}
           chown root:root /etc/kubernetes/kubelet.conf
           ```

        4. On every worker node, re-check the permissions to verify the fix:
           ```bash theme={null}
           stat -c 'file=%n permissions=%a owner=%U group=%G' /etc/kubernetes/kubelet.conf
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change file permissions on node-local paths such as `/etc/kubernetes/kubelet.conf`; this must be fixed directly on every worker node’s host OS. Use the steps in the Manual Steps section to adjust the permissions and verify the remediation.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        set -euo pipefail

        # Automation for: Ensure Kubelet Kubeconfig File Permissions Are 644 Or More Restrictive
        # Scope: run on every worker node (or from an admin host using SSH fan-out, see notes below)

        KUBELET_KUBECONFIG="/etc/kubernetes/kubelet.conf"
        DESIRED_MODE="644"
        EXIT_CODE=0

        echo "=== [$(hostname)] Checking kubelet kubeconfig permissions ==="

        if [ ! -e "$KUBELET_KUBECONFIG" ]; then
          echo "File not found: $KUBELET_KUBECONFIG (nothing to change on this node)"
          exit 0
        fi

        # Show current state
        CURRENT_MODE="$(stat -c '%a' "$KUBELET_KUBECONFIG")"
        echo "Current mode on $KUBELET_KUBECONFIG: $CURRENT_MODE"

        # Apply fix only if needed
        if [ "$CURRENT_MODE" != "$DESIRED_MODE" ]; then
          echo "Setting permissions to $DESIRED_MODE on $KUBELET_KUBECONFIG"
          chmod "$DESIRED_MODE" "$KUBELET_KUBECONFIG"
        else
          echo "Permissions already at $DESIRED_MODE; no change needed"
        fi

        # Verification (same logic as the audit command)
        echo "Verifying permissions..."
        VERIFY_OUTPUT="$(/bin/sh -c "if test -e $KUBELET_KUBECONFIG; then stat -c permissions=%a $KUBELET_KUBECONFIG; fi")"
        echo "$VERIFY_OUTPUT"

        if ! echo "$VERIFY_OUTPUT" | grep -q "permissions=$DESIRED_MODE"; then
          echo "ERROR: Expected permissions=$DESIRED_MODE but got: $VERIFY_OUTPUT" >&2
          EXIT_CODE=1
        else
          echo "Success: kubelet kubeconfig file permissions are set to $DESIRED_MODE"
        fi

        exit "$EXIT_CODE"
        ```

        Usage:

        * On each worker node (as root or with sudo):
          ```bash theme={null}
          sudo bash ./fix-kubelet-kubeconfig-perms.sh
          ```

        * From an admin machine with SSH access to all worker nodes (example with a simple host list):
          ```bash theme={null}
          # workers.txt contains one worker hostname or IP per line
          while read -r node; do
            echo "=== $node ==="
            ssh "root@$node" 'bash -s' < fix-kubelet-kubeconfig-perms.sh
          done < workers.txt
          ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>