> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure API Server Pod Specification Permissions Are Restrictive

### More Info:

Ensure that the API server pod specification file has permissions of 644 or more restrictive.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, check the current permissions of the API server pod specification file:
           ```sh theme={null}
           stat -c permissions=%a /etc/kubernetes/manifests/kube-apiserver.yaml
           ```

        2. If the reported permissions are more permissive than 644 (for example, 664, 666, 744, 755, 777), restrict them with:
           ```sh theme={null}
           chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml
           ```

        3. (Optional) Confirm file ownership is appropriate (typically root:root) and adjust if needed:
           ```sh theme={null}
           stat -c '%U:%G' /etc/kubernetes/manifests/kube-apiserver.yaml
           chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml
           ```

        4. Be aware: editing this static pod manifest may trigger a restart of the kube-apiserver container on that control plane node as the kubelet re-reads the manifest directory.

        5. Re-verify on every control plane node that the permissions are now compliant:
           ```sh theme={null}
           stat -c permissions=%a /etc/kubernetes/manifests/kube-apiserver.yaml
           ```
           The output should show:
           ```text theme={null}
           permissions=644
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change file permissions on control plane nodes, so this finding cannot be fixed via the Kubernetes API. The permissions must be updated directly on each control plane node’s filesystem (for example, with `chmod` on `/etc/kubernetes/manifests/kube-apiserver.yaml`); see the Manual Steps section for how to do this.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Fix CISKubernetes 1.1.1:
        # Ensure /etc/kubernetes/manifests/kube-apiserver.yaml has permissions 644 or more restrictive.
        # Run on every control plane node.

        set -euo pipefail

        APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
        TARGET_MODE="644"

        echo "=== CISKubernetes 1.1.1: Fix API server pod spec permissions ==="

        if [ ! -e "$APISERVER_MANIFEST" ]; then
          echo "INFO: $APISERVER_MANIFEST does not exist on this node. Nothing to do."
          exit 0
        fi

        current_mode="$(stat -c '%a' "$APISERVER_MANIFEST")"
        echo "Current permissions: $current_mode"

        # Normalize permission to be no more permissive than 644.
        # If already 644 or more restrictive (e.g. 640, 600), leave as-is.
        if [ "$current_mode" -gt "$TARGET_MODE" ]; then
          echo "Updating permissions to $TARGET_MODE on $APISERVER_MANIFEST"
          chmod "$TARGET_MODE" "$APISERVER_MANIFEST"
        else
          echo "Permissions are already $current_mode (644 or more restrictive). No change needed."
        fi

        # Verification
        echo "Verifying permissions..."
        verified_mode="$(stat -c '%a' "$APISERVER_MANIFEST")"
        echo "Verified permissions: $verified_mode"

        if [ "$verified_mode" -le "$TARGET_MODE" ]; then
          echo "SUCCESS: $APISERVER_MANIFEST permissions are $verified_mode (644 or more restrictive)."
          exit 0
        else
          echo "ERROR: $APISERVER_MANIFEST permissions are $verified_mode (not 644 or more restrictive)." >&2
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/)