> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Admin Configuration File Permissions Are 600

### More Info:

Ensure that the admin.conf file has permissions of 600.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, check the current permissions of the file:
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/admin.conf
           ```

        2. If the file exists and permissions are more permissive than 600, restrict them:
           ```bash theme={null}
           sudo chmod 600 /etc/kubernetes/admin.conf
           ```

        3. (Optional) Ensure ownership is correct (root:root is typical):
           ```bash theme={null}
           stat -c 'owner=%U group=%G' /etc/kubernetes/admin.conf
           # if needed:
           # sudo chown root:root /etc/kubernetes/admin.conf
           ```

        4. Verify the permissions have been correctly applied:
           ```bash theme={null}
           /bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c permissions=%a /etc/kubernetes/admin.conf; fi'
           ```
           The output should be:
           ```text theme={null}
           permissions=600
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify host-level file permissions such as `/etc/kubernetes/admin.conf` on control plane nodes. File mode changes must be made directly on each control plane node over SSH; see the Manual Steps section for the exact commands to run there.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Purpose: Ensure /etc/kubernetes/admin.conf has permissions 600
        # Scope:   Run on every control plane node (as root)
        # Usage:   sudo bash ./fix-admin-conf-perms.sh

        set -euo pipefail

        ADMIN_CONF="/etc/kubernetes/admin.conf"
        DESIRED_PERMS="600"

        echo "=== Ensuring permissions on ${ADMIN_CONF} are ${DESIRED_PERMS} ==="

        # Check if file exists; if not, nothing to do on this node
        if [ ! -e "${ADMIN_CONF}" ]; then
          echo "File ${ADMIN_CONF} does not exist on this node. Skipping."
          exit 0
        fi

        # Get current permissions (numeric, e.g. 644)
        current_perms="$(stat -c '%a' "${ADMIN_CONF}")"
        echo "Current permissions: ${current_perms}"

        # Apply fix only if needed (idempotent)
        if [ "${current_perms}" != "${DESIRED_PERMS}" ]; then
          echo "Updating permissions to ${DESIRED_PERMS}..."
          chmod "${DESIRED_PERMS}" "${ADMIN_CONF}"
        else
          echo "Permissions already set to ${DESIRED_PERMS}. No change needed."
        fi

        # Verification (same logic as audit command, with explicit check)
        echo "Verifying final permissions..."
        final_perms="$(stat -c 'permissions=%a' "${ADMIN_CONF}")"
        echo "${final_perms}"

        if [ "${final_perms}" = "permissions=${DESIRED_PERMS}" ]; then
          echo "SUCCESS: ${ADMIN_CONF} permissions are correctly set to ${DESIRED_PERMS}."
          exit 0
        else
          echo "ERROR: Expected permissions=${DESIRED_PERMS}, but found ${final_perms}."
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/)