> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubelet Configuration File Ownership Is Set To root:root

### More Info:

The kubelet configuration file should be owned by root:root to ensure that only the root user can read or modify it. Incorrect ownership could allow unauthorized users to tamper with kubelet configuration.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, SSH in and check the current ownership of the kubelet config file:
           ```bash theme={null}
           stat -c %U:%G /home/kubernetes/kubelet-config.yaml
           ```

        2. On every worker node, change the file ownership to root:root:
           ```bash theme={null}
           sudo chown root:root /home/kubernetes/kubelet-config.yaml
           ```

        3. (Optional but recommended) Ensure root is the only user with write access:
           ```bash theme={null}
           sudo chmod 644 /home/kubernetes/kubelet-config.yaml
           ```

        4. On every worker node, verify the ownership is now correct:
           ```bash theme={null}
           stat -c %U:%G /home/kubernetes/kubelet-config.yaml
           ```
           Expected output:
           ```text theme={null}
           root:root
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file ownership on nodes, so this finding cannot be fixed via the Kubernetes API. To remediate, you must change the ownership of `/home/kubernetes/kubelet-config.yaml` directly on every worker node’s host OS; see the Manual Steps section for the exact commands.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix CIS GKE 3.1.4: Ensure Kubelet Configuration File Ownership Is Set To root:root
        #
        # Run on: every worker node (as root)
        # Safe to re-run: yes

        set -euo pipefail

        CONFIG_FILE="/etc/kubernetes/kubelet-config.yaml"
        TARGET_OWNER="root"
        TARGET_GROUP="root"

        echo "==> CIS GKE 3.1.4 remediation on host: ${HOSTNAME}"

        if [ ! -e "${CONFIG_FILE}" ]; then
          echo "Config file not found at ${CONFIG_FILE}; nothing to change on this node."
          exit 0
        fi

        echo "Current ownership:"
        stat -c '  %n -> %U:%G' "${CONFIG_FILE}"

        # Apply fix
        echo "Setting ownership to ${TARGET_OWNER}:${TARGET_GROUP}..."
        chown "${TARGET_OWNER}:${TARGET_GROUP}" "${CONFIG_FILE}"

        # Verification (adapted from audit command)
        echo "Verifying ownership..."
        OWNERSHIP="$(stat -c %U:%G "${CONFIG_FILE}")"

        if [ "${OWNERSHIP}" = "${TARGET_OWNER}:${TARGET_GROUP}" ]; then
          echo "PASS: ${CONFIG_FILE} ownership is ${OWNERSHIP}"
          exit 0
        else
          echo "FAIL: ${CONFIG_FILE} ownership is ${OWNERSHIP}, expected ${TARGET_OWNER}:${TARGET_GROUP}" >&2
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>