Skip to main content

Ensure Kubelet Configuration File Ownership Is Set Root

More Info:​

Ensure that the certificate authorities file ownership is set to root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AKS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check the current ownership of the kubelet configuration file:

    sudo stat -c %U:%G /var/lib/kubelet/config.yaml

  2. On every worker node, set the ownership of the kubelet configuration file to root:root:

    sudo chown root:root /var/lib/kubelet/config.yaml

  3. (If desired) Confirm filesystem permissions did not become overly permissive while changing ownership:

    sudo stat -c '%n %a %U:%G' /var/lib/kubelet/config.yaml

  4. On every worker node, verify the fix using the audit command:

    /bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G /var/lib/kubelet/config.yaml; fi'

    The output must be:

    root:root
Using kubectl

kubectl cannot modify file ownership on worker node filesystems, so it cannot be used to fix the ownership of /var/lib/kubelet/config.yaml. Perform the remediation directly on every worker node’s host OS as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
#
# Remediation: Ensure kubelet configuration file ownership is set to root:root
# Scope: Run on every worker node
# Safe to re-run (idempotent)

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
REQUIRED_OWNER="root"
REQUIRED_GROUP="root"

echo "==> Checking for kubelet config file: ${KUBELET_CONFIG}"

if [ ! -e "${KUBELET_CONFIG}" ]; then
  echo "Kubelet config file not found at ${KUBELET_CONFIG}. Nothing to change on this node."
  exit 0
fi

current_owner="$(stat -c %U "${KUBELET_CONFIG}")"
current_group="$(stat -c %G "${KUBELET_CONFIG}")"

echo "Current ownership: ${current_owner}:${current_group}"

# Apply fix only if needed
if [ "${current_owner}" != "${REQUIRED_OWNER}" ] || [ "${current_group}" != "${REQUIRED_GROUP}" ]; then
  echo "Updating ownership to ${REQUIRED_OWNER}:${REQUIRED_GROUP} ..."
  chown "${REQUIRED_OWNER}:${REQUIRED_GROUP}" "${KUBELET_CONFIG}"
else
  echo "Ownership already correct. No changes made."
fi

# Verification (same logic as the audit command)
echo "==> Verifying ownership..."
verify_owner="$(stat -c %U "${KUBELET_CONFIG}")"
verify_group="$(stat -c %G "${KUBELET_CONFIG}")"
echo "Verified ownership: ${verify_owner}:${verify_group}"

if [ "${verify_owner}" = "${REQUIRED_OWNER}" ] && [ "${verify_group}" = "${REQUIRED_GROUP}" ]; then
  echo "SUCCESS: ${KUBELET_CONFIG} ownership is correctly set to ${REQUIRED_OWNER}:${REQUIRED_GROUP}"
  exit 0
else
  echo "ERROR: Failed to set ownership to ${REQUIRED_OWNER}:${REQUIRED_GROUP}" >&2
  exit 1
fi

Usage (run on every worker node, as root):

bash ./fix-kubelet-config-ownership.sh

Additional Reading:​