Kube-Proxy Kubeconfig File Permissions Are 644 Or More

More Info:

The kube-proxy kubeconfig file should have permissions of 644 or more restrictive so that only authorized users can read or modify it. Overly permissive permissions could allow unauthorized users to alter proxy configuration.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS GKE

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every worker node, check the current permissions of the kubeconfig file:

   stat -c permissions=%a /var/lib/kubelet/kubeconfig

2. On every worker node, set the kubeconfig file permissions to 644:

   chmod 644 /var/lib/kubelet/kubeconfig

3. On every worker node, optionally ensure the file is owned by root (adjust if your environment requires a different owner/group):

   chown root:root /var/lib/kubelet/kubeconfig

4. On every worker node, verify the permissions are now 644 or more restrictive (e.g., 640, 600):

   stat -c permissions=%a /var/lib/kubelet/kubeconfig

Using kubectl

kubectl cannot modify host-level file permissions such as /var/lib/kubelet/kubeconfig on worker nodes. To remediate this finding, you must change the file mode directly on each worker node’s filesystem; see the Manual Steps section for the exact commands.

Automation

#!/usr/bin/env bash
# Purpose: Ensure /var/lib/kubelet/kubeconfig permissions are 0644 on all worker nodes
# Usage: Run on any machine with SSH access to every worker node.
#        Provide a file with one worker node (hostname or IP) per line.
#
# Example:
#   ./fix-kubeconfig-perms.sh workers.txt

set -euo pipefail

WORKER_LIST_FILE="${1:-}"

if [[ -z "$WORKER_LIST_FILE" || ! -f "$WORKER_LIST_FILE" ]]; then
  echo "Usage: $0 /path/to/worker-nodes.txt" >&2
  exit 1
fi

# SSH options (tune as needed)
SSH_OPTS="-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5"

fix_node() {
  local node="$1"
  echo "=== [$node] Checking /var/lib/kubelet/kubeconfig ==="

  ssh $SSH_OPTS "$node" 'bash -s' << 'REMOTE_EOF'
set -euo pipefail

FILE="/var/lib/kubelet/kubeconfig"

if [[ ! -e "$FILE" ]]; then
  echo "File not found: $FILE (skipping)"
  exit 0
fi

CURRENT_PERMS="$(stat -c %a "$FILE")"

# Make idempotent: only change if needed
if [[ "$CURRENT_PERMS" != "644" ]]; then
  echo "Current permissions: $CURRENT_PERMS, setting to 644"
  chmod 644 "$FILE"
else
  echo "Permissions already 644 (no change needed)"
fi

# Verification (mirrors audit)
stat -c permissions=%a "$FILE"
REMOTE_EOF
}

while IFS= read -r node; do
  # Skip blank lines and comments
  [[ -z "$node" || "$node" =~ ^# ]] && continue
  fix_node "$node" || echo "!!! Failed on $node" >&2
done < "$WORKER_LIST_FILE"