> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubelet Config File Permissions Are Restrictive

### More Info:

Ensure that if the kubelet refers to a configuration file with the --config argument, that file has permissions of 644 or more restrictive.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check the current permissions of the kubelet config file:
           ```bash theme={null}
           stat -c permissions=%a /var/lib/kubelet/config.yaml
           ```

        2. On every worker node, set the permissions to 644 as required:
           ```bash theme={null}
           chmod 644 /var/lib/kubelet/config.yaml
           ```

        3. (Optional, if you want to enforce ownership as well) On every worker node, ensure root owns the file:
           ```bash theme={null}
           chown root:root /var/lib/kubelet/config.yaml
           ```

        4. On every worker node, verify the permissions are now compliant:
           ```bash theme={null}
           stat -c permissions=%a /var/lib/kubelet/config.yaml
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions or systemd configuration on cluster nodes, so this kubelet config file finding must be remediated directly on every worker node’s host OS. Use SSH and follow the guidance in the Manual Steps section to update `/var/lib/kubelet/config.yaml` permissions.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Purpose: Enforce restrictive permissions (0644) on /var/lib/kubelet/config.yaml
        # Scope:   Run on every worker node (and any control plane node that also runs kubelet)
        # Usage:   sudo /root/fix-kubelet-config-perms.sh

        set -euo pipefail

        KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
        DESIRED_MODE="644"

        echo "==> Checking for kubelet config at ${KUBELET_CONFIG}"

        if [[ ! -e "${KUBELET_CONFIG}" ]]; then
          echo "Kubelet config file not found at ${KUBELET_CONFIG}; nothing to change on this node."
        else
          # Get current permissions (numeric)
          CURRENT_MODE=$(stat -c '%a' "${KUBELET_CONFIG}")

          if [[ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]]; then
            echo "Current permissions ${CURRENT_MODE} on ${KUBELET_CONFIG} are too permissive or incorrect."
            echo "Setting permissions to ${DESIRED_MODE} ..."
            chmod "${DESIRED_MODE}" "${KUBELET_CONFIG}"
          else
            echo "Permissions already set to ${DESIRED_MODE} on ${KUBELET_CONFIG}; no change needed."
          fi

          # Verification (same as audit logic)
          echo "==> Verifying permissions on ${KUBELET_CONFIG}"
          stat -c 'permissions=%a path=%n' "${KUBELET_CONFIG}"
        fi

        echo "Done."
        ```

        Run this script on every worker node (and any other node running kubelet):

        ```bash theme={null}
        sudo bash /root/fix-kubelet-config-perms.sh
        ```

        To fan this out from a central machine with SSH access, you can use:

        ```bash theme={null}
        # Replace the hostnames/IPs with your worker nodes
        for NODE in worker1 worker2 worker3; do
          scp fix-kubelet-config-perms.sh "root@${NODE}:/root/"
          ssh "root@${NODE}" "bash /root/fix-kubelet-config-perms.sh"
        done
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/](https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/)