Skip to main content

API Server Pod Specification Permissions Are Restrictive

More Info:​

Ensure that the API server pod specification file has permissions of 644 or more restrictive.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current permissions of the API server pod specification file:

    stat -c permissions=%a /etc/kubernetes/manifests/kube-apiserver.yaml

  2. If the reported permissions are more permissive than 644 (for example, 664, 666, 744, 755, 777), restrict them with:

    chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml

  3. (Optional) Confirm file ownership is appropriate (typically root:root) and adjust if needed:

    stat -c '%U:%G' /etc/kubernetes/manifests/kube-apiserver.yaml
    chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml

  4. Be aware: editing this static pod manifest may trigger a restart of the kube-apiserver container on that control plane node as the kubelet re-reads the manifest directory.

  5. Re-verify on every control plane node that the permissions are now compliant:

    stat -c permissions=%a /etc/kubernetes/manifests/kube-apiserver.yaml

    The output should show:

    permissions=644
Using kubectl

kubectl cannot change file permissions on control plane nodes, so this finding cannot be fixed via the Kubernetes API. The permissions must be updated directly on each control plane node’s filesystem (for example, with chmod on /etc/kubernetes/manifests/kube-apiserver.yaml); see the Manual Steps section for how to do this.

Automation
#!/usr/bin/env bash
# Fix CISKubernetes 1.1.1:
# Ensure /etc/kubernetes/manifests/kube-apiserver.yaml has permissions 644 or more restrictive.
# Run on every control plane node.

set -euo pipefail

APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
TARGET_MODE="644"

echo "=== CISKubernetes 1.1.1: Fix API server pod spec permissions ==="

if [ ! -e "$APISERVER_MANIFEST" ]; then
  echo "INFO: $APISERVER_MANIFEST does not exist on this node. Nothing to do."
  exit 0
fi

current_mode="$(stat -c '%a' "$APISERVER_MANIFEST")"
echo "Current permissions: $current_mode"

# Normalize permission to be no more permissive than 644.
# If already 644 or more restrictive (e.g. 640, 600), leave as-is.
if [ "$current_mode" -gt "$TARGET_MODE" ]; then
  echo "Updating permissions to $TARGET_MODE on $APISERVER_MANIFEST"
  chmod "$TARGET_MODE" "$APISERVER_MANIFEST"
else
  echo "Permissions are already $current_mode (644 or more restrictive). No change needed."
fi

# Verification
echo "Verifying permissions..."
verified_mode="$(stat -c '%a' "$APISERVER_MANIFEST")"
echo "Verified permissions: $verified_mode"

if [ "$verified_mode" -le "$TARGET_MODE" ]; then
  echo "SUCCESS: $APISERVER_MANIFEST permissions are $verified_mode (644 or more restrictive)."
  exit 0
else
  echo "ERROR: $APISERVER_MANIFEST permissions are $verified_mode (not 644 or more restrictive)." >&2
  exit 1
fi

Additional Reading:​