Skip to main content

Ensure Proxy Kubeconfig File Permissions Are Restrictive

More Info:​

If kube-proxy is running, and if it is using a file-based kubeconfig file, ensure that the proxy kubeconfig file has permissions of 644 or more restrictive.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check whether the kube-proxy kubeconfig file exists and view its current permissions:

    ls -l /var/lib/kube-proxy/config.conf

  2. On every worker node where the file exists, set the permissions to 644 (owner read/write, group read, others read):

    chmod 644 /var/lib/kube-proxy/config.conf

  3. (Optional, but recommended) On every worker node, ensure the file is owned by the kube-proxy user and group if applicable in your environment (use the correct user/group if different):

    chown root:root /var/lib/kube-proxy/config.conf

  4. On every worker node, verify the permissions are now 644 or more restrictive:

    stat -c permissions=%a /var/lib/kube-proxy/config.conf

    Confirm the output shows permissions=644 (or a more restrictive value such as 600).

Using kubectl

kubectl cannot modify file permissions or other host-level settings on worker nodes, including /var/lib/kube-proxy/config.conf. This fix must be applied directly on each worker node’s OS; see the Manual Steps section for the exact commands to run over SSH.

Automation
#!/usr/bin/env bash
#
# Hardens kube-proxy kubeconfig permissions on every worker node over SSH.
# Usage:
#   1) Create a file with one worker node hostname/IP per line, e.g. workers.txt
#   2) Run: ./fix-kube-proxy-kubeconfig-perms.sh workers.txt
#
# Requirements:
#   - Passwordless SSH or SSH agent configured for the target nodes.
#   - User must have sudo privileges on the worker nodes.

set -euo pipefail

if [ "${1-}" = "" ]; then
  echo "Usage: $0 <workers_node_list_file>"
  exit 1
fi

NODES_FILE="$1"

if [ ! -f "$NODES_FILE" ]; then
  echo "Node list file not found: $NODES_FILE"
  exit 1
fi

KUBECONFIG_PATH="/var/lib/kube-proxy/config.conf"
DESIRED_MODE="644"

harden_node() {
  local node="$1"
  echo "==> Processing worker node: $node"

  ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "$node" bash -s -- "$KUBECONFIG_PATH" "$DESIRED_MODE" << 'EOSSH'
set -euo pipefail

KUBECONFIG_PATH="$1"
DESIRED_MODE="$2"

if [ ! -e "$KUBECONFIG_PATH" ]; then
  echo "    [INFO] kube-proxy kubeconfig not found at $KUBECONFIG_PATH, skipping."
  exit 0
fi

current_mode="$(stat -c '%a' "$KUBECONFIG_PATH")" || {
  echo "    [ERROR] Failed to read permissions for $KUBECONFIG_PATH"
  exit 1
}

if [ "$current_mode" != "$DESIRED_MODE" ]; then
  echo "    [INFO] Current mode: $current_mode, setting to $DESIRED_MODE"
  sudo chmod "$DESIRED_MODE" "$KUBECONFIG_PATH"
else
  echo "    [OK] Permissions already $DESIRED_MODE; no change needed."
fi

# Verification (adapted from the audit)
verify_mode="$(stat -c 'permissions=%a' "$KUBECONFIG_PATH")"
echo "    [VERIFY] $KUBECONFIG_PATH -> $verify_mode"

if [ "$verify_mode" != "permissions=$DESIRED_MODE" ]; then
  echo "    [FAIL] Permissions not set correctly on $KUBECONFIG_PATH"
  exit 1
fi

echo "    [SUCCESS] kube-proxy kubeconfig permissions are correctly set."
EOSSH

  echo
}

while IFS= read -r node; do
  # Skip empty lines and comments
  if [ -z "$node" ] || [[ "$node" =~ ^# ]]; then
    continue
  fi
  harden_node "$node"
done < "$NODES_FILE"

echo "All done."

Additional Reading:​