Skip to main content

Ensure Kubelet Config File Permissions Are Restrictive

More Info:​

Ensure that if the kubelet refers to a configuration file with the --config argument, that file has permissions of 644 or more restrictive.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check the current permissions of the kubelet config file:

    stat -c permissions=%a /var/lib/kubelet/config.yaml

  2. On every worker node, set the permissions to 644 as required:

    chmod 644 /var/lib/kubelet/config.yaml

  3. (Optional, if you want to enforce ownership as well) On every worker node, ensure root owns the file:

    chown root:root /var/lib/kubelet/config.yaml

  4. On every worker node, verify the permissions are now compliant:

    stat -c permissions=%a /var/lib/kubelet/config.yaml
Using kubectl

kubectl cannot modify file permissions or systemd configuration on cluster nodes, so this kubelet config file finding must be remediated directly on every worker node’s host OS. Use SSH and follow the guidance in the Manual Steps section to update /var/lib/kubelet/config.yaml permissions.

Automation
#!/usr/bin/env bash
#
# Purpose: Enforce restrictive permissions (0644) on /var/lib/kubelet/config.yaml
# Scope:   Run on every worker node (and any control plane node that also runs kubelet)
# Usage:   sudo /root/fix-kubelet-config-perms.sh

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
DESIRED_MODE="644"

echo "==> Checking for kubelet config at ${KUBELET_CONFIG}"

if [[ ! -e "${KUBELET_CONFIG}" ]]; then
  echo "Kubelet config file not found at ${KUBELET_CONFIG}; nothing to change on this node."
else
  # Get current permissions (numeric)
  CURRENT_MODE=$(stat -c '%a' "${KUBELET_CONFIG}")

  if [[ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]]; then
    echo "Current permissions ${CURRENT_MODE} on ${KUBELET_CONFIG} are too permissive or incorrect."
    echo "Setting permissions to ${DESIRED_MODE} ..."
    chmod "${DESIRED_MODE}" "${KUBELET_CONFIG}"
  else
    echo "Permissions already set to ${DESIRED_MODE} on ${KUBELET_CONFIG}; no change needed."
  fi

  # Verification (same as audit logic)
  echo "==> Verifying permissions on ${KUBELET_CONFIG}"
  stat -c 'permissions=%a path=%n' "${KUBELET_CONFIG}"
fi

echo "Done."

Run this script on every worker node (and any other node running kubelet):

sudo bash /root/fix-kubelet-config-perms.sh

To fan this out from a central machine with SSH access, you can use:

# Replace the hostnames/IPs with your worker nodes
for NODE in worker1 worker2 worker3; do
  scp fix-kubelet-config-perms.sh "root@${NODE}:/root/"
  ssh "root@${NODE}" "bash /root/fix-kubelet-config-perms.sh"
done

Additional Reading:​