Skip to main content

Ensure Kubelet Configuration File Ownership Is Set To Root

More Info:​

Ensure that the kubelet.conf file ownership is set to root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS GKE
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check current ownership of the kubelet configuration file:

    stat -c %U:%G /etc/kubernetes/kubelet-config.yaml

  2. On every worker node, change the file owner and group to root:

    sudo chown root:root /etc/kubernetes/kubelet-config.yaml

  3. (Optional, if you want to enforce permissions as well) On every worker node, restrict the file permissions:

    sudo chmod 600 /etc/kubernetes/kubelet-config.yaml

  4. On every worker node, verify the ownership is now correct:

    stat -c %U:%G /etc/kubernetes/kubelet-config.yaml

    The output must be:

    root:root
Using kubectl

kubectl cannot modify host-level file ownership for /etc/kubernetes/kubelet-config.yaml on worker nodes. This must be fixed directly on each node’s OS (over SSH or similar) by adjusting file ownership; see the Manual Steps section for the exact commands.

Automation
#!/usr/bin/env bash
#
# Remediate CIS GKE 3.1.4 on every worker node:
# Ensure /etc/kubernetes/kubelet-config.yaml is owned by root:root
#
# Run this script on each worker node (e.g. via SSH, Ansible shell, or your CM tool).

set -euo pipefail

CONFIG_FILE="/etc/kubernetes/kubelet-config.yaml"

echo "=== CIS GKE 3.1.4: Ensure kubelet configuration file ownership is set to root:root ==="

if [ ! -e "$CONFIG_FILE" ]; then
  echo "File not found: $CONFIG_FILE"
  echo "Nothing to change on this node."
else
  current_owner_group="$(stat -c '%U:%G' "$CONFIG_FILE")"
  echo "Current ownership: $CONFIG_FILE -> $current_owner_group"

  if [ "$current_owner_group" != "root:root" ]; then
    echo "Updating ownership to root:root ..."
    chown root:root "$CONFIG_FILE"
  else
    echo "Ownership already set to root:root, no change needed."
  fi

  echo "Verifying ownership ..."
  verify_owner_group="$(stat -c '%U:%G' "$CONFIG_FILE")"
  echo "Post-change ownership: $CONFIG_FILE -> $verify_owner_group"

  if [ "$verify_owner_group" != "root:root" ]; then
    echo "ERROR: Failed to set ownership to root:root for $CONFIG_FILE" >&2
    exit 1
  fi

  echo "SUCCESS: $CONFIG_FILE ownership is correctly set to root:root"
fi

Additional Reading:​