Skip to main content

Ensure Kubelet Config File Ownership Is Root

More Info:​

Ensure that if the kubelet refers to a configuration file with the --config argument, that file is owned by root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check the current ownership of the kubelet configuration file:

    stat -c %U:%G /var/lib/kubelet/config.yaml

  2. On every worker node, change the ownership of the kubelet configuration file to root:root:

    sudo chown root:root /var/lib/kubelet/config.yaml

  3. (If desired) Confirm file permissions did not become overly permissive while changing ownership:

    stat -c '%a %n' /var/lib/kubelet/config.yaml

  4. On every worker node, verify the fix using the benchmark’s audit command:

    /bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G /var/lib/kubelet/config.yaml; fi'

    The output must be:

    root:root
Using kubectl

kubectl cannot change file ownership on worker node filesystems, including /etc/kubernetes/kubelet.conf or /var/lib/kubelet/config.yaml; this must be remediated directly on each worker node via host-level commands. Refer to the Manual Steps section for the exact chown command and verification steps to run over SSH on every worker node.

Automation
#!/usr/bin/env bash
#
# Remediate CIS Kubernetes 4.1.10:
# Ensure kubelet config file /var/lib/kubelet/config.yaml is owned by root:root
#
# Run on: every worker node (and any control-plane node that also runs kubelet)
# Usage: sudo ./fix-kubelet-config-ownership.sh

set -euo pipefail

CONFIG_FILE="/var/lib/kubelet/config.yaml"

echo "[-] Checking for kubelet config file at ${CONFIG_FILE}"

if [ ! -e "${CONFIG_FILE}" ]; then
  echo "[*] File ${CONFIG_FILE} does not exist on this node. Nothing to do."
  exit 0
fi

# Get current ownership
CURRENT_OWNER_GROUP="$(stat -c '%U:%G' "${CONFIG_FILE}")"

echo "[-] Current ownership of ${CONFIG_FILE}: ${CURRENT_OWNER_GROUP}"

# If already root:root, nothing to change
if [ "${CURRENT_OWNER_GROUP}" = "root:root" ]; then
  echo "[*] Ownership already set to root:root. No changes made."
else
  echo "[-] Setting ownership of ${CONFIG_FILE} to root:root"
  chown root:root "${CONFIG_FILE}"
fi

# Verification (adapted from audit command)
echo "[-] Verifying ownership after remediation"
FINAL_OWNER_GROUP="$(stat -c '%U:%G' "${CONFIG_FILE}")"
echo "[*] Final ownership of ${CONFIG_FILE}: ${FINAL_OWNER_GROUP}"

if [ "${FINAL_OWNER_GROUP}" != "root:root" ]; then
  echo "[!] ERROR: Failed to set ownership of ${CONFIG_FILE} to root:root" >&2
  exit 1
fi

echo "[+] Remediation successful: ${CONFIG_FILE} is owned by root:root"

Additional Reading:​