Skip to main content

Ensure API Server Pod Specification File Ownership Is Root

More Info:​

Ensure that the API server pod specification file ownership is set to root:root

Risk Level​

Low

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current ownership of the API server manifest:

    stat -c %U:%G /etc/kubernetes/manifests/kube-apiserver.yaml

  2. On every control plane node, set the file owner and group to root:

    sudo chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml

  3. On every control plane node, confirm the permissions and basic file info (optional sanity check):

    ls -l /etc/kubernetes/manifests/kube-apiserver.yaml

  4. On every control plane node, verify the fix using the audit-style command:

    /bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-apiserver.yaml; then stat -c %U:%G /etc/kubernetes/manifests/kube-apiserver.yaml; fi'

    The output must be:

    root:root
Using kubectl

kubectl cannot modify file ownership on the control-plane node filesystem, including /etc/kubernetes/manifests/kube-apiserver.yaml. This change must be made directly on every control plane node via host-level commands; see the Manual Steps section for the exact commands to run and how to verify the fix.

Automation
#!/usr/bin/env bash
# Automation to enforce root:root ownership on kube-apiserver pod spec
# Scope: run on every control plane node

set -euo pipefail

APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"

echo "=== [1/3] Checking for kube-apiserver manifest at ${APISERVER_MANIFEST}"

if [ ! -e "${APISERVER_MANIFEST}" ]; then
  echo "Manifest not found at ${APISERVER_MANIFEST}. Nothing to change on this node."
  exit 0
fi

echo "=== [2/3] Setting file owner and group to root:root (idempotent)"

# Idempotent: chown only if needed
current_owner_group="$(stat -c '%U:%G' "${APISERVER_MANIFEST}")"
if [ "${current_owner_group}" != "root:root" ]; then
  chown root:root "${APISERVER_MANIFEST}"
  echo "Updated ownership from ${current_owner_group} to root:root"
else
  echo "Ownership already root:root, no change needed"
fi

echo "=== [3/3] Verifying ownership (CIS 1.1.2 check)"

audit_output="$(stat -c %U:%G "${APISERVER_MANIFEST}")"
echo "Current ownership: ${audit_output}"

if [ "${audit_output}" != "root:root" ]; then
  echo "FAIL: Ownership is not root:root after remediation" >&2
  exit 1
fi

echo "PASS: kube-apiserver manifest ownership is correctly set to root:root"

Usage:

  • Run this script on every control plane node (e.g., via SSH, Ansible script module, or similar).
  • It is safe to re-run; it only changes ownership when needed.

Additional Reading:​