Skip to main content

Ensure Proxy Kubeconfig File Ownership Is Root

More Info:​

If kube-proxy is running, ensure that the file ownership of its kubeconfig file is set to root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, confirm the kube-proxy kubeconfig file exists and review its current ownership:

    ls -l /var/lib/kube-proxy/config.conf

  2. On every worker node, change the file owner and group to root:root:

    sudo chown root:root /var/lib/kube-proxy/config.conf

  3. (Optional, only if permissions also need tightening) On every worker node, restrict permissions to owner read/write only:

    sudo chmod 600 /var/lib/kube-proxy/config.conf

  4. On every worker node, verify the ownership is now root:root:

    stat -c %U:%G /var/lib/kube-proxy/config.conf
Using kubectl

kubectl cannot change file ownership on worker node filesystems, including /var/lib/kube-proxy/config.conf. This must be fixed directly on every worker node via host-level commands; follow the Manual Steps section to update ownership and verify.

Automation
#!/usr/bin/env bash
#
# Remediation: Ensure Proxy Kubeconfig File Ownership Is Root (CIS GKE 3.1.2)
# Target: every worker node
#
# Run this script on each worker node (as root). It is safe to re-run.

set -euo pipefail

KUBEPROXY_KUBECONFIG="/var/lib/kube-proxy/config.conf"

echo "==> Checking for kube-proxy kubeconfig at: ${KUBEPROXY_KUBECONFIG}"

if [ ! -e "${KUBEPROXY_KUBECONFIG}" ]; then
  echo "File not found: ${KUBEPROXY_KUBECONFIG}"
  echo "Nothing to change on this node (kube-proxy may not be running here)."
  exit 0
fi

# Current ownership
current_owner="$(stat -c '%U:%G' "${KUBEPROXY_KUBECONFIG}")"
echo "Current ownership: ${current_owner}"

# Desired ownership is root:root
if [ "${current_owner}" != "root:root" ]; then
  echo "Updating ownership to root:root ..."
  chown root:root "${KUBEPROXY_KUBECONFIG}"
else
  echo "Ownership already set to root:root; no change needed."
fi

# Verification step (adapted from the audit concept, for the correct file)
echo "==> Verifying ownership..."
verify_owner="$(stat -c '%U:%G' "${KUBEPROXY_KUBECONFIG}")"
echo "Verified ownership: ${verify_owner}"

if [ "${verify_owner}" != "root:root" ]; then
  echo "ERROR: Ownership still not root:root on ${KUBEPROXY_KUBECONFIG}" >&2
  exit 1
fi

echo "Remediation successful on this worker node."

Additional Reading:​