> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kube-Proxy Kubeconfig File Permissions Are 644 Or More Restrictive

### More Info:

The kube-proxy kubeconfig file should have permissions of 644 or more restrictive so that only authorized users can read or modify it. Overly permissive permissions could allow unauthorized users to alter proxy configuration.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check the current permissions of the kubeconfig file:
           ```bash theme={null}
           stat -c permissions=%a /var/lib/kubelet/kubeconfig
           ```

        2. On every worker node, set the kubeconfig file permissions to 644:
           ```bash theme={null}
           chmod 644 /var/lib/kubelet/kubeconfig
           ```

        3. On every worker node, optionally ensure the file is owned by root (adjust if your environment requires a different owner/group):
           ```bash theme={null}
           chown root:root /var/lib/kubelet/kubeconfig
           ```

        4. On every worker node, verify the permissions are now 644 or more restrictive (e.g., 640, 600):
           ```bash theme={null}
           stat -c permissions=%a /var/lib/kubelet/kubeconfig
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify host-level file permissions such as `/var/lib/kubelet/kubeconfig` on worker nodes. To remediate this finding, you must change the file mode directly on each worker node’s filesystem; see the Manual Steps section for the exact commands.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Purpose: Ensure /var/lib/kubelet/kubeconfig permissions are 0644 on all worker nodes
        # Usage: Run on any machine with SSH access to every worker node.
        #        Provide a file with one worker node (hostname or IP) per line.
        #
        # Example:
        #   ./fix-kubeconfig-perms.sh workers.txt

        set -euo pipefail

        WORKER_LIST_FILE="${1:-}"

        if [[ -z "$WORKER_LIST_FILE" || ! -f "$WORKER_LIST_FILE" ]]; then
          echo "Usage: $0 /path/to/worker-nodes.txt" >&2
          exit 1
        fi

        # SSH options (tune as needed)
        SSH_OPTS="-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5"

        fix_node() {
          local node="$1"
          echo "=== [$node] Checking /var/lib/kubelet/kubeconfig ==="

          ssh $SSH_OPTS "$node" 'bash -s' << 'REMOTE_EOF'
        set -euo pipefail

        FILE="/var/lib/kubelet/kubeconfig"

        if [[ ! -e "$FILE" ]]; then
          echo "File not found: $FILE (skipping)"
          exit 0
        fi

        CURRENT_PERMS="$(stat -c %a "$FILE")"

        # Make idempotent: only change if needed
        if [[ "$CURRENT_PERMS" != "644" ]]; then
          echo "Current permissions: $CURRENT_PERMS, setting to 644"
          chmod 644 "$FILE"
        else
          echo "Permissions already 644 (no change needed)"
        fi

        # Verification (mirrors audit)
        stat -c permissions=%a "$FILE"
        REMOTE_EOF
        }

        while IFS= read -r node; do
          # Skip blank lines and comments
          [[ -z "$node" || "$node" =~ ^# ]] && continue
          fix_node "$node" || echo "!!! Failed on $node" >&2
        done < "$WORKER_LIST_FILE"
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>