Skip to main content

Ensure Kubelet Configuration File Permissions Restrictive

More Info:​

Ensure that the kubelet.conf file has permissions of 644 or more restrictive

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS GKE
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check the current permissions of the kubelet configuration file:

    stat -c permissions=%a /etc/kubernetes/kubelet-config.yaml

  2. On every worker node, set the file permissions to 644 as required:

    chmod 644 /etc/kubernetes/kubelet-config.yaml

  3. (Optional, on every worker node) Confirm file ownership is appropriate for your environment (commonly root:root):

    ls -l /etc/kubernetes/kubelet-config.yaml

  4. On every worker node, verify the permissions are now compliant:

    stat -c permissions=%a /etc/kubernetes/kubelet-config.yaml
Using kubectl

kubectl cannot modify file permissions on node-local paths such as /etc/kubernetes/kubelet-config.yaml; this must be fixed directly on every worker node via host-level access (for example, SSH). Refer to the Manual Steps section for the exact commands to run on each node.

Automation
#!/usr/bin/env bash
#
# Remediation: Ensure kubelet configuration file permissions are 644 or more restrictive
# Scope: Run on every worker node
# Idempotent: Yes, safe to re-run

set -euo pipefail

KUBELET_CONF="/etc/kubernetes/kubelet-config.yaml"

echo "=== CIS GKE 3.1.3: Ensure Kubelet Configuration File Permissions Restrictive ==="

# 1. Check if the kubelet configuration file exists
if [ ! -e "$KUBELET_CONF" ]; then
  echo "File not found: $KUBELET_CONF"
  echo "Nothing to change on this node."
  exit 0
fi

# 2. Show current permissions
CURRENT_PERMS="$(stat -c '%a' "$KUBELET_CONF")"
echo "Current permissions on $KUBELET_CONF: $CURRENT_PERMS"

# 3. Apply restrictive permissions (644) if needed
if [ "$CURRENT_PERMS" != "644" ]; then
  echo "Setting permissions on $KUBELET_CONF to 644..."
  chmod 644 "$KUBELET_CONF"
else
  echo "Permissions already set to 644. No change needed."
fi

# 4. Verification (same logic as audit command)
echo "Verifying resulting permissions..."
FINAL_PERMS="$(stat -c 'permissions=%a' "$KUBELET_CONF")"
echo "$FINAL_PERMS"

if [ "$FINAL_PERMS" != "permissions=644" ]; then
  echo "ERROR: Expected permissions=644 but found $FINAL_PERMS"
  exit 1
fi

echo "Success: $KUBELET_CONF permissions are correctly set to 644."

Usage:

  • Copy this script to a file, for example /usr/local/sbin/fix-cis-gke-3.1.3.sh.
  • Run on every worker node as root:
bash /usr/local/sbin/fix-cis-gke-3.1.3.sh

Additional Reading:​