Skip to main content

Ensure Admin Configuration File Ownership Is Root

More Info:​

Ensure that the admin.conf file ownership is set to root:root.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current ownership of the admin.conf file:

    stat -c %U:%G /etc/kubernetes/admin.conf

  2. If the output is not root:root, change the ownership to root:root:

    sudo chown root:root /etc/kubernetes/admin.conf

  3. (Optional but recommended) Ensure the file exists and is not world-writable:

    ls -l /etc/kubernetes/admin.conf

  4. Verify the fix on every control plane node using the audit command:

    /bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %U:%G /etc/kubernetes/admin.conf; fi'

    Confirm the output is:

    root:root
Using kubectl

kubectl cannot modify file ownership on control plane nodes, so it cannot be used to fix /etc/kubernetes/admin.conf. This change must be made directly on each control plane node’s filesystem; see the Manual Steps section for the exact commands to run there.

Automation
#!/usr/bin/env bash
#
# Fix ownership of /etc/kubernetes/admin.conf to root:root
# Scope: run on every control plane node
# Safe to re-run (idempotent)

set -euo pipefail

ADMIN_CONF="/etc/kubernetes/admin.conf"

echo "=== [CIS 1.1.14] Ensure admin.conf ownership is root:root ==="

if [ ! -e "$ADMIN_CONF" ]; then
  echo "File not found: $ADMIN_CONF"
  echo "Nothing to do on this node."
  exit 0
fi

# Show current ownership
current_owner="$(stat -c '%U:%G' "$ADMIN_CONF")"
echo "Current ownership: $current_owner"

# Apply fix if needed
if [ "$current_owner" != "root:root" ]; then
  echo "Setting ownership to root:root on $ADMIN_CONF"
  chown root:root "$ADMIN_CONF"
else
  echo "Ownership already correct; no change needed."
fi

# Verification (same as audit command)
echo "Verifying ownership..."
verify_owner="$(stat -c '%U:%G' "$ADMIN_CONF")"
echo "Verified ownership: $verify_owner"

if [ "$verify_owner" != "root:root" ]; then
  echo "ERROR: Ownership is still not root:root. Manual investigation required." >&2
  exit 1
fi

echo "=== Compliance OK on this node ==="

Additional Reading:​