Skip to main content

Kubelet Configuration File Ownership Is Set To root:root

More Info:​

The kubelet configuration file should be owned by root:root to ensure that only the root user can read or modify it. Incorrect ownership could allow unauthorized users to tamper with kubelet configuration.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, SSH in and check the current ownership of the kubelet config file:

    stat -c %U:%G /home/kubernetes/kubelet-config.yaml

  2. On every worker node, change the file ownership to root:root:

    sudo chown root:root /home/kubernetes/kubelet-config.yaml

  3. (Optional but recommended) Ensure root is the only user with write access:

    sudo chmod 644 /home/kubernetes/kubelet-config.yaml

  4. On every worker node, verify the ownership is now correct:

    stat -c %U:%G /home/kubernetes/kubelet-config.yaml

    Expected output:

    root:root
Using kubectl

kubectl cannot modify file ownership on nodes, so this finding cannot be fixed via the Kubernetes API. To remediate, you must change the ownership of /home/kubernetes/kubelet-config.yaml directly on every worker node’s host OS; see the Manual Steps section for the exact commands.

Automation
#!/usr/bin/env bash
#
# Fix CIS GKE 3.1.4: Ensure Kubelet Configuration File Ownership Is Set To root:root
#
# Run on: every worker node (as root)
# Safe to re-run: yes

set -euo pipefail

CONFIG_FILE="/etc/kubernetes/kubelet-config.yaml"
TARGET_OWNER="root"
TARGET_GROUP="root"

echo "==> CIS GKE 3.1.4 remediation on host: ${HOSTNAME}"

if [ ! -e "${CONFIG_FILE}" ]; then
  echo "Config file not found at ${CONFIG_FILE}; nothing to change on this node."
  exit 0
fi

echo "Current ownership:"
stat -c '  %n -> %U:%G' "${CONFIG_FILE}"

# Apply fix
echo "Setting ownership to ${TARGET_OWNER}:${TARGET_GROUP}..."
chown "${TARGET_OWNER}:${TARGET_GROUP}" "${CONFIG_FILE}"

# Verification (adapted from audit command)
echo "Verifying ownership..."
OWNERSHIP="$(stat -c %U:%G "${CONFIG_FILE}")"

if [ "${OWNERSHIP}" = "${TARGET_OWNER}:${TARGET_GROUP}" ]; then
  echo "PASS: ${CONFIG_FILE} ownership is ${OWNERSHIP}"
  exit 0
else
  echo "FAIL: ${CONFIG_FILE} ownership is ${OWNERSHIP}, expected ${TARGET_OWNER}:${TARGET_GROUP}" >&2
  exit 1
fi