Skip to main content

Controller Manager Configuration File Permissions Are Restrictive

More Info:​

Ensure that the controller-manager.conf file has permissions of 644 or more restrictive

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current permissions of the file (if it exists):

    stat -c permissions=%a /etc/kubernetes/controller-manager.conf 2>/dev/null || echo "File not found"

  2. If the file exists and permissions are more permissive than 644 (e.g., 666, 664, 777), tighten them:

    chmod 644 /etc/kubernetes/controller-manager.conf

  3. Confirm the ownership is appropriate (usually root:root); adjust if needed:

    stat -c "owner=%U group=%G" /etc/kubernetes/controller-manager.conf
    chown root:root /etc/kubernetes/controller-manager.conf

  4. Re-verify the permissions are now 644:

    stat -c permissions=%a /etc/kubernetes/controller-manager.conf
Using kubectl

kubectl cannot modify host-level file permissions such as /etc/kubernetes/controller-manager.conf on control plane nodes. To remediate this finding, you must change the file permissions directly on every control plane node; see the Manual Steps section for the exact commands.

Automation
#!/usr/bin/env bash
#
# Fix CISKubernetes 1.1.17:
# Ensure /etc/kubernetes/controller-manager.conf permissions are 644 or more restrictive
#
# Usage:
#   Run on every control plane node as root (or with sudo):
#     sudo bash ./fix-controller-manager-conf-perms.sh
#
# Idempotent: safe to re-run.

set -euo pipefail

CONFIG_PATH="/etc/kubernetes/controller-manager.conf"
REQUIRED_MODE="644"

echo "=== Checking for ${CONFIG_PATH} ==="
if [ ! -e "${CONFIG_PATH}" ]; then
  echo "File not found: ${CONFIG_PATH}"
  echo "Nothing to do on this node."
  exit 0
fi

# Get current permissions in numeric form (e.g. 640, 644)
CURRENT_MODE="$(stat -c '%a' "${CONFIG_PATH}")"
echo "Current permissions: ${CURRENT_MODE}"

if [ "${CURRENT_MODE}" = "${REQUIRED_MODE}" ]; then
  echo "Permissions already set to ${REQUIRED_MODE}. No change needed."
else
  echo "Setting permissions on ${CONFIG_PATH} to ${REQUIRED_MODE}"
  chmod "${REQUIRED_MODE}" "${CONFIG_PATH}"
fi

echo "=== Verifying permissions ==="
/bin/sh -c "stat -c permissions=%a ${CONFIG_PATH}"

FINAL_MODE="$(stat -c '%a' "${CONFIG_PATH}")"
if [ "${FINAL_MODE}" != "${REQUIRED_MODE}" ]; then
  echo "ERROR: Expected permissions ${REQUIRED_MODE}, but found ${FINAL_MODE} after chmod." >&2
  exit 1
fi

echo "Permissions successfully set to ${REQUIRED_MODE} on ${CONFIG_PATH}."

Additional Reading:​