Ensure Kubelet Configuration File Permissions Are Set To 644

More Info:

The kubelet configuration file should have permissions of 644 or more restrictive so that only authorized users can read or modify it. Overly permissive permissions could allow unauthorized modification of kubelet behavior.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS GKE

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every worker node, check the current permissions of the kubelet configuration file:

   stat -c permissions=%a /home/kubernetes/kubelet-config.yaml

2. On every worker node, set the kubelet configuration file permissions to 644:

   chmod 644 /home/kubernetes/kubelet-config.yaml

3. On every worker node, ensure the file owner is root (adjust if needed for your environment):

   chown root:root /home/kubernetes/kubelet-config.yaml

4. On every worker node, verify the permissions are now correctly set (adapted from the audit command):

   stat -c permissions=%a /home/kubernetes/kubelet-config.yaml

   Confirm the output is:

   permissions=644

Using kubectl

kubectl cannot modify file permissions on worker nodes, so it cannot be used to fix this finding on /home/kubernetes/kubelet-config.yaml. To remediate, you must change the permissions directly on every worker node’s filesystem; see the Manual Steps section for the exact commands to run over SSH.

Automation

#!/usr/bin/env bash
#
# Fix CIS GKE 3.1.3: Ensure Kubelet Configuration File Permissions Are Set To 644
# Target: every worker node
#
# Usage:
#   1) Create a file "workers.txt" with one worker node (hostname or IP) per line.
#   2) Ensure SSH key-based auth and sudo privileges are configured for the remote user.
#   3) Run: ./fix-kubelet-perms.sh workers.txt
#
# This script is idempotent and safe to re-run.

set -euo pipefail

if [[ $# -ne 1 ]]; then
  echo "Usage: $0 <workers_list_file>" >&2
  exit 1
fi

WORKERS_FILE="$1"

if [[ ! -f "$WORKERS_FILE" ]]; then
  echo "Workers list file not found: $WORKERS_FILE" >&2
  exit 1
fi

REMOTE_USER="${REMOTE_USER:-ubuntu}"   # set REMOTE_USER env if different
KUBELET_CONFIG_PATH="/home/kubernetes/kubelet-config.yaml"

while IFS= read -r NODE || [[ -n "$NODE" ]]; do
  # Skip empty lines and comments
  [[ -z "$NODE" || "$NODE" =~ ^# ]] && continue

  echo "==== Processing worker node: $NODE ===="

  ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "${REMOTE_USER}@${NODE}" bash -s <<EOF
set -euo pipefail

CONFIG_PATH="$KUBELET_CONFIG_PATH"

if [[ ! -e "\$CONFIG_PATH" ]]; then
  echo "[$NODE] kubelet config file not found at \$CONFIG_PATH - skipping"
  exit 0
fi

CURRENT_PERMS=\$(stat -c "%a" "\$CONFIG_PATH")
echo "[$NODE] Current permissions: \$CURRENT_PERMS"

# Apply remediation only if needed
if [[ "\$CURRENT_PERMS" != "644" ]]; then
  echo "[$NODE] Updating permissions to 644"
  sudo chmod 644 "\$CONFIG_PATH"
else
  echo "[$NODE] Permissions already 644 - no change needed"
fi

# Verification (adapted from audit command)
VERIFY_PERMS=\$(stat -c "permissions=%a" "\$CONFIG_PATH")
echo "[$NODE] Verification: \$VERIFY_PERMS"

if [[ "\$VERIFY_PERMS" != "permissions=644" ]]; then
  echo "[$NODE] ERROR: verification failed, expected permissions=644 but got \$VERIFY_PERMS" >&2
  exit 1
fi

echo "[$NODE] Success: kubelet config permissions correctly set to 644"
EOF

  echo
done < "$WORKERS_FILE"

echo "All listed worker nodes processed."