> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure API Server Pod Specification File Ownership Is Root

### More Info:

Ensure that the API server pod specification file ownership is set to root:root

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, check the current ownership of the API server manifest:
           ```sh theme={null}
           stat -c %U:%G /etc/kubernetes/manifests/kube-apiserver.yaml
           ```

        2. On every control plane node, set the file owner and group to root:
           ```sh theme={null}
           sudo chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml
           ```

        3. On every control plane node, confirm the permissions and basic file info (optional sanity check):
           ```sh theme={null}
           ls -l /etc/kubernetes/manifests/kube-apiserver.yaml
           ```

        4. On every control plane node, verify the fix using the audit-style command:
           ```sh theme={null}
           /bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-apiserver.yaml; then stat -c %U:%G /etc/kubernetes/manifests/kube-apiserver.yaml; fi'
           ```
           The output must be:
           ```text theme={null}
           root:root
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file ownership on the control-plane node filesystem, including `/etc/kubernetes/manifests/kube-apiserver.yaml`. This change must be made directly on every control plane node via host-level commands; see the Manual Steps section for the exact commands to run and how to verify the fix.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Automation to enforce root:root ownership on kube-apiserver pod spec
        # Scope: run on every control plane node

        set -euo pipefail

        APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"

        echo "=== [1/3] Checking for kube-apiserver manifest at ${APISERVER_MANIFEST}"

        if [ ! -e "${APISERVER_MANIFEST}" ]; then
          echo "Manifest not found at ${APISERVER_MANIFEST}. Nothing to change on this node."
          exit 0
        fi

        echo "=== [2/3] Setting file owner and group to root:root (idempotent)"

        # Idempotent: chown only if needed
        current_owner_group="$(stat -c '%U:%G' "${APISERVER_MANIFEST}")"
        if [ "${current_owner_group}" != "root:root" ]; then
          chown root:root "${APISERVER_MANIFEST}"
          echo "Updated ownership from ${current_owner_group} to root:root"
        else
          echo "Ownership already root:root, no change needed"
        fi

        echo "=== [3/3] Verifying ownership (CIS 1.1.2 check)"

        audit_output="$(stat -c %U:%G "${APISERVER_MANIFEST}")"
        echo "Current ownership: ${audit_output}"

        if [ "${audit_output}" != "root:root" ]; then
          echo "FAIL: Ownership is not root:root after remediation" >&2
          exit 1
        fi

        echo "PASS: kube-apiserver manifest ownership is correctly set to root:root"
        ```

        Usage:

        * Run this script on every control plane node (e.g., via SSH, Ansible `script` module, or similar).
        * It is safe to re-run; it only changes ownership when needed.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)