> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubelet Config File Ownership Is Root

### More Info:

Ensure that if the kubelet refers to a configuration file with the --config argument, that file is owned by root:root.

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check the current ownership of the kubelet configuration file:
           ```sh theme={null}
           stat -c %U:%G /var/lib/kubelet/config.yaml
           ```

        2. On every worker node, change the ownership of the kubelet configuration file to root:root:
           ```sh theme={null}
           sudo chown root:root /var/lib/kubelet/config.yaml
           ```

        3. (If desired) Confirm file permissions did not become overly permissive while changing ownership:
           ```sh theme={null}
           stat -c '%a %n' /var/lib/kubelet/config.yaml
           ```

        4. On every worker node, verify the fix using the benchmark’s audit command:
           ```sh theme={null}
           /bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G /var/lib/kubelet/config.yaml; fi'
           ```
           The output must be:
           ```text theme={null}
           root:root
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change file ownership on worker node filesystems, including `/etc/kubernetes/kubelet.conf` or `/var/lib/kubelet/config.yaml`; this must be remediated directly on each worker node via host-level commands. Refer to the Manual Steps section for the exact `chown` command and verification steps to run over SSH on every worker node.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediate CIS Kubernetes 4.1.10:
        # Ensure kubelet config file /var/lib/kubelet/config.yaml is owned by root:root
        #
        # Run on: every worker node (and any control-plane node that also runs kubelet)
        # Usage: sudo ./fix-kubelet-config-ownership.sh

        set -euo pipefail

        CONFIG_FILE="/var/lib/kubelet/config.yaml"

        echo "[-] Checking for kubelet config file at ${CONFIG_FILE}"

        if [ ! -e "${CONFIG_FILE}" ]; then
          echo "[*] File ${CONFIG_FILE} does not exist on this node. Nothing to do."
          exit 0
        fi

        # Get current ownership
        CURRENT_OWNER_GROUP="$(stat -c '%U:%G' "${CONFIG_FILE}")"

        echo "[-] Current ownership of ${CONFIG_FILE}: ${CURRENT_OWNER_GROUP}"

        # If already root:root, nothing to change
        if [ "${CURRENT_OWNER_GROUP}" = "root:root" ]; then
          echo "[*] Ownership already set to root:root. No changes made."
        else
          echo "[-] Setting ownership of ${CONFIG_FILE} to root:root"
          chown root:root "${CONFIG_FILE}"
        fi

        # Verification (adapted from audit command)
        echo "[-] Verifying ownership after remediation"
        FINAL_OWNER_GROUP="$(stat -c '%U:%G' "${CONFIG_FILE}")"
        echo "[*] Final ownership of ${CONFIG_FILE}: ${FINAL_OWNER_GROUP}"

        if [ "${FINAL_OWNER_GROUP}" != "root:root" ]; then
          echo "[!] ERROR: Failed to set ownership of ${CONFIG_FILE} to root:root" >&2
          exit 1
        fi

        echo "[+] Remediation successful: ${CONFIG_FILE} is owned by root:root"
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/](https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/)