> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kube-Proxy Kubeconfig File Ownership Is Set To root:root

### More Info:

The kube-proxy kubeconfig file should be owned by root:root to ensure that only the root user can read or modify it. Incorrect ownership could allow unauthorized users to tamper with proxy configuration.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, confirm the kubelet kubeconfig file exists and check its current ownership:
           ```bash theme={null}
           ls -l /var/lib/kubelet/kubeconfig
           stat -c %U:%G /var/lib/kubelet/kubeconfig
           ```

        2. On every worker node, change the ownership of the kubeconfig file to root:root:
           ```bash theme={null}
           sudo chown root:root /var/lib/kubelet/kubeconfig
           ```

        3. (Optional, for hardening) On every worker node, restrict permissions to read/write for root only:
           ```bash theme={null}
           sudo chmod 600 /var/lib/kubelet/kubeconfig
           ```

        4. On every worker node, verify the ownership (and optionally permissions) are correct:
           ```bash theme={null}
           stat -c %U:%G /var/lib/kubelet/kubeconfig
           stat -c '%a %n' /var/lib/kubelet/kubeconfig
           ```
           Expected ownership: `root:root` (and permissions such as `600` if you applied step 3).
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify host-level file ownership, so it cannot be used to fix the ownership of `/var/lib/kubelet/kubeconfig` on worker nodes. This remediation must be performed directly on each node’s filesystem (over SSH or your node management tooling); see the Manual Steps section for the exact commands.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix CIS GKE 3.1.2: Ensure kubelet kubeconfig file ownership is set to root:root
        # Scope: run on every worker node (as root). Safe to re-run.

        set -euo pipefail

        KUBECONFIG_PATH="/var/lib/kubelet/kubeconfig"
        DESIRED_OWNER="root"
        DESIRED_GROUP="root"

        echo "=== CIS GKE 3.1.2: kubelet kubeconfig ownership ==="

        if [ ! -e "$KUBECONFIG_PATH" ]; then
          echo "INFO: $KUBECONFIG_PATH does not exist on this node; nothing to do."
          exit 0
        fi

        current_owner="$(stat -c '%U' "$KUBECONFIG_PATH")"
        current_group="$(stat -c '%G' "$KUBECONFIG_PATH")"

        if [ "$current_owner" = "$DESIRED_OWNER" ] && [ "$current_group" = "$DESIRED_GROUP" ]; then
          echo "OK: $KUBECONFIG_PATH already owned by ${DESIRED_OWNER}:${DESIRED_GROUP}."
        else
          echo "FIX: Setting ownership of $KUBECONFIG_PATH to ${DESIRED_OWNER}:${DESIRED_GROUP}..."
          chown "${DESIRED_OWNER}:${DESIRED_GROUP}" "$KUBECONFIG_PATH"
        fi

        echo "=== Verifying ownership ==="
        /bin/sh -c "if test -e $KUBECONFIG_PATH; then stat -c %U:%G $KUBECONFIG_PATH; fi"

        final_owner_group="$(stat -c '%U:%G' "$KUBECONFIG_PATH")"
        if [ "$final_owner_group" != "${DESIRED_OWNER}:${DESIRED_GROUP}" ]; then
          echo "ERROR: Ownership verification failed; expected ${DESIRED_OWNER}:${DESIRED_GROUP}, got $final_owner_group" >&2
          exit 1
        fi

        echo "SUCCESS: $KUBECONFIG_PATH ownership is ${DESIRED_OWNER}:${DESIRED_GROUP}."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>