Skip to main content

Kubelet Configuration File Has Permissions Restrictive

More Info:​

Ensure that the certificate authorities file has permissions of 644 or more restrictive.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AKS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check the current permissions of the kubelet configuration file:

    stat -c permissions=%a /var/lib/kubelet/config.yaml

  2. If the permissions are more permissive than 644 (e.g., 664, 666, 777), set them to 644:

    chmod 644 /var/lib/kubelet/config.yaml

  3. Re-verify the permissions on the same worker node:

    stat -c permissions=%a /var/lib/kubelet/config.yaml

  4. Repeat steps 1–3 on every worker node in the cluster.

Using kubectl

kubectl cannot modify file permissions on worker node files such as /var/lib/kubelet/config.yaml; this must be fixed directly on each worker node’s host OS. Use SSH or your node management tooling to apply the permission change as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
#
# Remediates CIS AKS 3.1.3 on every worker node by enforcing 0644 on
# /var/lib/kubelet/config.yaml, if it exists.
#
# Usage (from any machine with SSH access to worker nodes):
#   ./fix-kubelet-config-perms.sh node1.example.com node2.example.com ...
#
# Requires: passwordless sudo on target nodes (or interactive sudo).

set -euo pipefail

if [ "$#" -lt 1 ]; then
  echo "Usage: $0 <worker-node-1> [worker-node-2 ...]" >&2
  exit 1
fi

REMOTE_USER="${REMOTE_USER:-$(whoami)}"

for NODE in "$@"; do
  echo "=== Processing worker node: $NODE ==="

  ssh -o BatchMode=yes -o ConnectTimeout=10 "${REMOTE_USER}@${NODE}" /bin/bash -s << 'EOF' || {
    echo "!! Failed to connect or run commands on $NODE" >&2
    continue
  }
set -euo pipefail

CONFIG_PATH="/var/lib/kubelet/config.yaml"

if [ ! -e "\$CONFIG_PATH" ]; then
  echo "  - \$CONFIG_PATH does not exist on this node; nothing to do."
  exit 0
fi

CURRENT_PERMS="$(stat -c '%a' "\$CONFIG_PATH")"
echo "  - Current permissions: \$CURRENT_PERMS"

# Enforce 0644 if different
if [ "\$CURRENT_PERMS" != "644" ]; then
  echo "  - Setting permissions to 0644"
  sudo chmod 644 "\$CONFIG_PATH"
else
  echo "  - Permissions already 0644; no change needed."
fi

# Verification (matches the audit logic)
VERIFY_PERMS="$(stat -c 'permissions=%a' "\$CONFIG_PATH")"
echo "  - Verification: \$VERIFY_PERMS"

if [ "\$VERIFY_PERMS" != "permissions=644" ]; then
  echo "  !! Verification failed on \$CONFIG_PATH (expected permissions=644)" >&2
  exit 1
fi

echo "  - Remediation successful on this node."
EOF

done

echo "=== Completed remediation across all provided worker nodes ==="

Additional Reading:​