Skip to main content

Ensure Kubelet Kubeconfig File Ownership Is Set Root

More Info:​

Ensure that the kubelet.conf file ownership is set to root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AKS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check if the kubelet kubeconfig file exists and inspect its current ownership:

    sudo stat -c '%n %U:%G' /etc/kubernetes/kubelet.conf

  2. On every worker node, if the file exists and is not owned by root:root, change its ownership:

    sudo chown root:root /etc/kubernetes/kubelet.conf

  3. On every worker node, verify the ownership is now correctly set to root:root:

    sudo stat -c %U:%G /etc/kubernetes/kubelet.conf
Using kubectl

kubectl cannot modify host-level file ownership, so it cannot be used to change /etc/kubernetes/kubelet.conf to root:root. Perform the fix directly on every worker node’s filesystem as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
# Purpose: Ensure /etc/kubernetes/kubelet.conf ownership is root:root on every worker node.
# Run on: any machine with SSH access to all worker nodes.

set -euo pipefail

# COMMA-SEPARATED list of worker node hostnames or IPs.
# Example: WORKER_NODES="worker1,worker2,10.0.0.15"
WORKER_NODES="worker1,worker2"

SSH_USER="root"   # Change if you use a different SSH user with sudo rights.

IFS=',' read -r -a NODES <<< "$WORKER_NODES"

remote_fix_script='
set -euo pipefail

FILE="/etc/kubernetes/kubelet.conf"

if [ ! -e "$FILE" ]; then
  echo "SKIP: $FILE not found on $(hostname)"
  exit 0
fi

current_owner="$(stat -c "%U:%G" "$FILE")"

if [ "$current_owner" != "root:root" ]; then
  echo "FIX: changing ownership of $FILE from $current_owner to root:root on $(hostname)"
  chown root:root "$FILE"
else
  echo "OK: ownership of $FILE already root:root on $(hostname)"
fi

echo -n "VERIFY: $(hostname) -> "
stat -c "%U:%G %n" "$FILE"
'

for node in "${NODES[@]}"; do
  echo "===== Processing node: $node ====="
  ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" "$remote_fix_script"
  echo
done

Additional Reading:​