Skip to main content

Controller Manager Pod Specification File Ownership Is Root

More Info:​

Ensure that the controller manager pod specification file ownership is set to root:root.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, confirm the controller manager manifest exists and check its current ownership:

    sudo ls -l /etc/kubernetes/manifests/kube-controller-manager.yaml
    sudo stat -c %U:%G /etc/kubernetes/manifests/kube-controller-manager.yaml

  2. On every control plane node, set the file owner and group to root:

    sudo chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml

  3. (Optional) On every control plane node, ensure any configuration management or bootstrap scripts (if present) also set the correct ownership so it is not reverted. For example, inspect for references:

    sudo grep -R "kube-controller-manager.yaml" /etc /var -n || true

  4. Be aware that editing files under /etc/kubernetes/manifests can trigger a restart of the corresponding static pod, but changing ownership only should not modify the pod content. Proceed during a maintenance window if your change process requires it.

  5. On every control plane node, verify the ownership is now root:root:

    sudo stat -c %U:%G /etc/kubernetes/manifests/kube-controller-manager.yaml

    The output must be:

    root:root
Using kubectl

Kubectl cannot modify host-level file ownership for /etc/kubernetes/manifests/kube-controller-manager.yaml; this must be corrected directly on every control plane node via OS tools (for example, chown). See the Manual Steps section for the exact commands to run on the nodes.

Automation
#!/usr/bin/env bash
#
# Automation: Ensure kube-controller-manager pod spec file is owned by root:root
# Scope: Run on every control plane node
# Usage: sudo ./fix-kcm-ownership.sh

set -euo pipefail

KCM_MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml"
REQUIRED_OWNER="root"
REQUIRED_GROUP="root"

echo "=== Checking kube-controller-manager manifest ownership on this node ==="

if [ ! -e "$KCM_MANIFEST" ]; then
  echo "INFO: $KCM_MANIFEST does not exist on this node. Nothing to do."
  exit 0
fi

current_owner="$(stat -c %U "$KCM_MANIFEST")"
current_group="$(stat -c %G "$KCM_MANIFEST")"

echo "Current ownership: $current_owner:$current_group"
echo "Required ownership: $REQUIRED_OWNER:$REQUIRED_GROUP"

if [ "$current_owner" = "$REQUIRED_OWNER" ] && [ "$current_group" = "$REQUIRED_GROUP" ]; then
  echo "Ownership already correct. No changes needed."
else
  echo "Fixing ownership..."
  chown "${REQUIRED_OWNER}:${REQUIRED_GROUP}" "$KCM_MANIFEST"
fi

echo "=== Verifying ownership ==="
stat -c %U:%G "$KCM_MANIFEST"

if [ "$(stat -c %U "$KCM_MANIFEST")" = "$REQUIRED_OWNER" ] && \
   [ "$(stat -c %G "$KCM_MANIFEST")" = "$REQUIRED_GROUP" ]; then
  echo "SUCCESS: $KCM_MANIFEST is owned by ${REQUIRED_OWNER}:${REQUIRED_GROUP}"
  exit 0
else
  echo "ERROR: Failed to enforce ownership on $KCM_MANIFEST" >&2
  exit 1
fi

Additional Reading:​