Skip to main content

Controller Manager Pod Specification File Permissions Are Restrictive

More Info:​

Ensure that the controller manager pod specification file has permissions of 644 or more restrictive.

Risk Level​

High

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current permissions of the controller manager manifest file:

    stat -c permissions=%a /etc/kubernetes/manifests/kube-controller-manager.yaml

  2. If the permissions are more permissive than 644 (e.g., 664, 666, 777), restrict them:

    chmod 644 /etc/kubernetes/manifests/kube-controller-manager.yaml

  3. Confirm the new permissions are correctly set (this runs the same way as the audit):

    stat -c permissions=%a /etc/kubernetes/manifests/kube-controller-manager.yaml
Using kubectl

kubectl cannot modify host-level file permissions for /etc/kubernetes/manifests/kube-controller-manager.yaml on control plane nodes. This fix must be applied directly on each control plane node’s filesystem; see the Manual Steps section for the required commands and procedure.

Automation
#!/usr/bin/env bash
#
# Remediation: Ensure kube-controller-manager pod spec file permissions are 644 or more restrictive
# Scope: Run on every control plane node
# Safe to re-run; only adjusts permissions if they are too permissive.

set -euo pipefail

TARGET_FILE="/etc/kubernetes/manifests/kube-controller-manager.yaml"
REQUIRED_MODE="644"

echo "=== kube-controller-manager pod spec permissions remediation ==="

if [ ! -e "${TARGET_FILE}" ]; then
  echo "Target file not found: ${TARGET_FILE}"
  echo "Nothing to remediate on this node."
  exit 0
fi

# Get current numeric permissions (e.g., 640, 644, 600)
current_mode="$(stat -c '%a' "${TARGET_FILE}")"
echo "Current permissions on ${TARGET_FILE}: ${current_mode}"

# Function to compare numeric modes as integers
is_more_permissive() {
  local cur="$1"
  local req="$2"
  # A mode is considered "more permissive" if it's numerically greater (e.g., 660 > 644)
  [ "${cur}" -gt "${req}" ]
}

if is_more_permissive "${current_mode}" "${REQUIRED_MODE}"; then
  echo "Permissions are too permissive. Setting to ${REQUIRED_MODE}..."
  chmod "${REQUIRED_MODE}" "${TARGET_FILE}"
else
  echo "Permissions are already ${REQUIRED_MODE} or more restrictive. No change needed."
fi

# Verification (mirrors the audit command)
echo "Verifying final permissions:"
/bin/sh -c "if test -e ${TARGET_FILE}; then stat -c permissions=%a ${TARGET_FILE}; fi"

echo "Remediation completed on this node."

Additional Reading:​