Skip to main content

Ensure Admin Configuration File Permissions Are 600

More Info:​

Ensure that the admin.conf file has permissions of 600.

Risk Level​

High

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current permissions of the file:

    stat -c permissions=%a /etc/kubernetes/admin.conf

  2. If the file exists and permissions are more permissive than 600, restrict them:

    sudo chmod 600 /etc/kubernetes/admin.conf

  3. (Optional) Ensure ownership is correct (root:root is typical):

    stat -c 'owner=%U group=%G' /etc/kubernetes/admin.conf
    # if needed:
    # sudo chown root:root /etc/kubernetes/admin.conf

  4. Verify the permissions have been correctly applied:

    /bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c permissions=%a /etc/kubernetes/admin.conf; fi'

    The output should be:

    permissions=600
Using kubectl

kubectl cannot modify host-level file permissions such as /etc/kubernetes/admin.conf on control plane nodes. File mode changes must be made directly on each control plane node over SSH; see the Manual Steps section for the exact commands to run there.

Automation
#!/usr/bin/env bash
#
# Purpose: Ensure /etc/kubernetes/admin.conf has permissions 600
# Scope:   Run on every control plane node (as root)
# Usage:   sudo bash ./fix-admin-conf-perms.sh

set -euo pipefail

ADMIN_CONF="/etc/kubernetes/admin.conf"
DESIRED_PERMS="600"

echo "=== Ensuring permissions on ${ADMIN_CONF} are ${DESIRED_PERMS} ==="

# Check if file exists; if not, nothing to do on this node
if [ ! -e "${ADMIN_CONF}" ]; then
  echo "File ${ADMIN_CONF} does not exist on this node. Skipping."
  exit 0
fi

# Get current permissions (numeric, e.g. 644)
current_perms="$(stat -c '%a' "${ADMIN_CONF}")"
echo "Current permissions: ${current_perms}"

# Apply fix only if needed (idempotent)
if [ "${current_perms}" != "${DESIRED_PERMS}" ]; then
  echo "Updating permissions to ${DESIRED_PERMS}..."
  chmod "${DESIRED_PERMS}" "${ADMIN_CONF}"
else
  echo "Permissions already set to ${DESIRED_PERMS}. No change needed."
fi

# Verification (same logic as audit command, with explicit check)
echo "Verifying final permissions..."
final_perms="$(stat -c 'permissions=%a' "${ADMIN_CONF}")"
echo "${final_perms}"

if [ "${final_perms}" = "permissions=${DESIRED_PERMS}" ]; then
  echo "SUCCESS: ${ADMIN_CONF} permissions are correctly set to ${DESIRED_PERMS}."
  exit 0
else
  echo "ERROR: Expected permissions=${DESIRED_PERMS}, but found ${final_perms}."
  exit 1
fi

Additional Reading:​