> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Controller Manager Configuration File Permissions Are Restrictive

### More Info:

Ensure that the controller-manager.conf file has permissions of 644 or more restrictive

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, check the current permissions of the file (if it exists):
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/controller-manager.conf 2>/dev/null || echo "File not found"
           ```

        2. If the file exists and permissions are more permissive than 644 (e.g., 666, 664, 777), tighten them:
           ```bash theme={null}
           chmod 644 /etc/kubernetes/controller-manager.conf
           ```

        3. Confirm the ownership is appropriate (usually root:root); adjust if needed:
           ```bash theme={null}
           stat -c "owner=%U group=%G" /etc/kubernetes/controller-manager.conf
           chown root:root /etc/kubernetes/controller-manager.conf
           ```

        4. Re-verify the permissions are now 644:
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/controller-manager.conf
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify host-level file permissions such as `/etc/kubernetes/controller-manager.conf` on control plane nodes. To remediate this finding, you must change the file permissions directly on every control plane node; see the Manual Steps section for the exact commands.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix CISKubernetes 1.1.17:
        # Ensure /etc/kubernetes/controller-manager.conf permissions are 644 or more restrictive
        #
        # Usage:
        #   Run on every control plane node as root (or with sudo):
        #     sudo bash ./fix-controller-manager-conf-perms.sh
        #
        # Idempotent: safe to re-run.

        set -euo pipefail

        CONFIG_PATH="/etc/kubernetes/controller-manager.conf"
        REQUIRED_MODE="644"

        echo "=== Checking for ${CONFIG_PATH} ==="
        if [ ! -e "${CONFIG_PATH}" ]; then
          echo "File not found: ${CONFIG_PATH}"
          echo "Nothing to do on this node."
          exit 0
        fi

        # Get current permissions in numeric form (e.g. 640, 644)
        CURRENT_MODE="$(stat -c '%a' "${CONFIG_PATH}")"
        echo "Current permissions: ${CURRENT_MODE}"

        if [ "${CURRENT_MODE}" = "${REQUIRED_MODE}" ]; then
          echo "Permissions already set to ${REQUIRED_MODE}. No change needed."
        else
          echo "Setting permissions on ${CONFIG_PATH} to ${REQUIRED_MODE}"
          chmod "${REQUIRED_MODE}" "${CONFIG_PATH}"
        fi

        echo "=== Verifying permissions ==="
        /bin/sh -c "stat -c permissions=%a ${CONFIG_PATH}"

        FINAL_MODE="$(stat -c '%a' "${CONFIG_PATH}")"
        if [ "${FINAL_MODE}" != "${REQUIRED_MODE}" ]; then
          echo "ERROR: Expected permissions ${REQUIRED_MODE}, but found ${FINAL_MODE} after chmod." >&2
          exit 1
        fi

        echo "Permissions successfully set to ${REQUIRED_MODE} on ${CONFIG_PATH}."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kube-controller-manager/](https://kubernetes.io/docs/admin/kube-controller-manager/)