> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Controller Manager Pod Specification File Permissions Are Restrictive

### More Info:

Ensure that the controller manager pod specification file has permissions of 644 or more restrictive.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, check the current permissions of the controller manager manifest file:
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/manifests/kube-controller-manager.yaml
           ```

        2. If the permissions are more permissive than 644 (e.g., 664, 666, 777), restrict them:
           ```bash theme={null}
           chmod 644 /etc/kubernetes/manifests/kube-controller-manager.yaml
           ```

        3. Confirm the new permissions are correctly set (this runs the same way as the audit):
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/manifests/kube-controller-manager.yaml
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify host-level file permissions for `/etc/kubernetes/manifests/kube-controller-manager.yaml` on control plane nodes. This fix must be applied directly on each control plane node’s filesystem; see the Manual Steps section for the required commands and procedure.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediation: Ensure kube-controller-manager pod spec file permissions are 644 or more restrictive
        # Scope: Run on every control plane node
        # Safe to re-run; only adjusts permissions if they are too permissive.

        set -euo pipefail

        TARGET_FILE="/etc/kubernetes/manifests/kube-controller-manager.yaml"
        REQUIRED_MODE="644"

        echo "=== kube-controller-manager pod spec permissions remediation ==="

        if [ ! -e "${TARGET_FILE}" ]; then
          echo "Target file not found: ${TARGET_FILE}"
          echo "Nothing to remediate on this node."
          exit 0
        fi

        # Get current numeric permissions (e.g., 640, 644, 600)
        current_mode="$(stat -c '%a' "${TARGET_FILE}")"
        echo "Current permissions on ${TARGET_FILE}: ${current_mode}"

        # Function to compare numeric modes as integers
        is_more_permissive() {
          local cur="$1"
          local req="$2"
          # A mode is considered "more permissive" if it's numerically greater (e.g., 660 > 644)
          [ "${cur}" -gt "${req}" ]
        }

        if is_more_permissive "${current_mode}" "${REQUIRED_MODE}"; then
          echo "Permissions are too permissive. Setting to ${REQUIRED_MODE}..."
          chmod "${REQUIRED_MODE}" "${TARGET_FILE}"
        else
          echo "Permissions are already ${REQUIRED_MODE} or more restrictive. No change needed."
        fi

        # Verification (mirrors the audit command)
        echo "Verifying final permissions:"
        /bin/sh -c "if test -e ${TARGET_FILE}; then stat -c permissions=%a ${TARGET_FILE}; fi"

        echo "Remediation completed on this node."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)