> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Proxy Kubeconfig File Permissions Are Restrictive

### More Info:

If kube-proxy is running, and if it is using a file-based kubeconfig file, ensure that the proxy kubeconfig file has permissions of 644 or more restrictive.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check whether the kube-proxy kubeconfig file exists and view its current permissions:
           ```sh theme={null}
           ls -l /var/lib/kube-proxy/config.conf
           ```

        2. On every worker node where the file exists, set the permissions to 644 (owner read/write, group read, others read):
           ```sh theme={null}
           chmod 644 /var/lib/kube-proxy/config.conf
           ```

        3. (Optional, but recommended) On every worker node, ensure the file is owned by the kube-proxy user and group if applicable in your environment (use the correct user/group if different):
           ```sh theme={null}
           chown root:root /var/lib/kube-proxy/config.conf
           ```

        4. On every worker node, verify the permissions are now 644 or more restrictive:
           ```sh theme={null}
           stat -c permissions=%a /var/lib/kube-proxy/config.conf
           ```
           Confirm the output shows `permissions=644` (or a more restrictive value such as `600`).
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions or other host-level settings on worker nodes, including `/var/lib/kube-proxy/config.conf`. This fix must be applied directly on each worker node’s OS; see the Manual Steps section for the exact commands to run over SSH.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Hardens kube-proxy kubeconfig permissions on every worker node over SSH.
        # Usage:
        #   1) Create a file with one worker node hostname/IP per line, e.g. workers.txt
        #   2) Run: ./fix-kube-proxy-kubeconfig-perms.sh workers.txt
        #
        # Requirements:
        #   - Passwordless SSH or SSH agent configured for the target nodes.
        #   - User must have sudo privileges on the worker nodes.

        set -euo pipefail

        if [ "${1-}" = "" ]; then
          echo "Usage: $0 <workers_node_list_file>"
          exit 1
        fi

        NODES_FILE="$1"

        if [ ! -f "$NODES_FILE" ]; then
          echo "Node list file not found: $NODES_FILE"
          exit 1
        fi

        KUBECONFIG_PATH="/var/lib/kube-proxy/config.conf"
        DESIRED_MODE="644"

        harden_node() {
          local node="$1"
          echo "==> Processing worker node: $node"

          ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "$node" bash -s -- "$KUBECONFIG_PATH" "$DESIRED_MODE" << 'EOSSH'
        set -euo pipefail

        KUBECONFIG_PATH="$1"
        DESIRED_MODE="$2"

        if [ ! -e "$KUBECONFIG_PATH" ]; then
          echo "    [INFO] kube-proxy kubeconfig not found at $KUBECONFIG_PATH, skipping."
          exit 0
        fi

        current_mode="$(stat -c '%a' "$KUBECONFIG_PATH")" || {
          echo "    [ERROR] Failed to read permissions for $KUBECONFIG_PATH"
          exit 1
        }

        if [ "$current_mode" != "$DESIRED_MODE" ]; then
          echo "    [INFO] Current mode: $current_mode, setting to $DESIRED_MODE"
          sudo chmod "$DESIRED_MODE" "$KUBECONFIG_PATH"
        else
          echo "    [OK] Permissions already $DESIRED_MODE; no change needed."
        fi

        # Verification (adapted from the audit)
        verify_mode="$(stat -c 'permissions=%a' "$KUBECONFIG_PATH")"
        echo "    [VERIFY] $KUBECONFIG_PATH -> $verify_mode"

        if [ "$verify_mode" != "permissions=$DESIRED_MODE" ]; then
          echo "    [FAIL] Permissions not set correctly on $KUBECONFIG_PATH"
          exit 1
        fi

        echo "    [SUCCESS] kube-proxy kubeconfig permissions are correctly set."
        EOSSH

          echo
        }

        while IFS= read -r node; do
          # Skip empty lines and comments
          if [ -z "$node" ] || [[ "$node" =~ ^# ]]; then
            continue
          fi
          harden_node "$node"
        done < "$NODES_FILE"

        echo "All done."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kube-proxy/](https://kubernetes.io/docs/admin/kube-proxy/)