> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubelet Configuration File Permissions Are Set To 644

### More Info:

The kubelet configuration file should have permissions of 644 or more restrictive so that only authorized users can read or modify it. Overly permissive permissions could allow unauthorized modification of kubelet behavior.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check the current permissions of the kubelet configuration file:
           ```sh theme={null}
           stat -c permissions=%a /home/kubernetes/kubelet-config.yaml
           ```

        2. On every worker node, set the kubelet configuration file permissions to 644:
           ```sh theme={null}
           chmod 644 /home/kubernetes/kubelet-config.yaml
           ```

        3. On every worker node, ensure the file owner is root (adjust if needed for your environment):
           ```sh theme={null}
           chown root:root /home/kubernetes/kubelet-config.yaml
           ```

        4. On every worker node, verify the permissions are now correctly set (adapted from the audit command):
           ```sh theme={null}
           stat -c permissions=%a /home/kubernetes/kubelet-config.yaml
           ```
           Confirm the output is:
           ```text theme={null}
           permissions=644
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on worker nodes, so it cannot be used to fix this finding on `/home/kubernetes/kubelet-config.yaml`. To remediate, you must change the permissions directly on every worker node’s filesystem; see the Manual Steps section for the exact commands to run over SSH.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix CIS GKE 3.1.3: Ensure Kubelet Configuration File Permissions Are Set To 644
        # Target: every worker node
        #
        # Usage:
        #   1) Create a file "workers.txt" with one worker node (hostname or IP) per line.
        #   2) Ensure SSH key-based auth and sudo privileges are configured for the remote user.
        #   3) Run: ./fix-kubelet-perms.sh workers.txt
        #
        # This script is idempotent and safe to re-run.

        set -euo pipefail

        if [[ $# -ne 1 ]]; then
          echo "Usage: $0 <workers_list_file>" >&2
          exit 1
        fi

        WORKERS_FILE="$1"

        if [[ ! -f "$WORKERS_FILE" ]]; then
          echo "Workers list file not found: $WORKERS_FILE" >&2
          exit 1
        fi

        REMOTE_USER="${REMOTE_USER:-ubuntu}"   # set REMOTE_USER env if different
        KUBELET_CONFIG_PATH="/home/kubernetes/kubelet-config.yaml"

        while IFS= read -r NODE || [[ -n "$NODE" ]]; do
          # Skip empty lines and comments
          [[ -z "$NODE" || "$NODE" =~ ^# ]] && continue

          echo "==== Processing worker node: $NODE ===="

          ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "${REMOTE_USER}@${NODE}" bash -s <<EOF
        set -euo pipefail

        CONFIG_PATH="$KUBELET_CONFIG_PATH"

        if [[ ! -e "\$CONFIG_PATH" ]]; then
          echo "[$NODE] kubelet config file not found at \$CONFIG_PATH - skipping"
          exit 0
        fi

        CURRENT_PERMS=\$(stat -c "%a" "\$CONFIG_PATH")
        echo "[$NODE] Current permissions: \$CURRENT_PERMS"

        # Apply remediation only if needed
        if [[ "\$CURRENT_PERMS" != "644" ]]; then
          echo "[$NODE] Updating permissions to 644"
          sudo chmod 644 "\$CONFIG_PATH"
        else
          echo "[$NODE] Permissions already 644 - no change needed"
        fi

        # Verification (adapted from audit command)
        VERIFY_PERMS=\$(stat -c "permissions=%a" "\$CONFIG_PATH")
        echo "[$NODE] Verification: \$VERIFY_PERMS"

        if [[ "\$VERIFY_PERMS" != "permissions=644" ]]; then
          echo "[$NODE] ERROR: verification failed, expected permissions=644 but got \$VERIFY_PERMS" >&2
          exit 1
        fi

        echo "[$NODE] Success: kubelet config permissions correctly set to 644"
        EOF

          echo
        done < "$WORKERS_FILE"

        echo "All listed worker nodes processed."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>