Ensure Client Certificate Authorities File Ownership Is Root

Manual Steps

On every worker node, identify the client CA file path used by kubelet:

CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
if test -z "$CAFILE"; then CAFILE=/etc/kubernetes/pki/ca.crt; fi
echo "$CAFILE"

Review the file and confirm it is the correct client CA for your environment (to avoid changing ownership on an unintended file):
ls -l "$CAFILE" openssl x509 -in "$CAFILE" -text -noout 2>/dev/null || echo "Not a certificate file, verify manually"
If this is not the expected CA, stop and determine the correct CA file before proceeding.
Change the file ownership to root:root (only after confirming in step 2):
sudo chown root:root "$CAFILE"
(Optional but recommended) Restrict permissions to read-only for root if compatible with your tooling:
sudo chmod 600 "$CAFILE"

Verify the ownership is now root:root using the audit logic on the same worker node:

CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
if test -z "$CAFILE"; then CAFILE=/etc/kubernetes/pki/ca.crt; fi
if test -e "$CAFILE"; then stat -c %U:%G "$CAFILE"; fi

Confirm the output is:

root:root

Using kubectl

kubectl cannot change file ownership on worker node filesystems, including the kubelet client CA file referenced by /var/lib/kubelet/config.yaml. To fix this finding you must adjust file ownership directly on every worker node at the host level; follow the guidance in the Manual Steps section.

Automation

#!/usr/bin/env bash
#
# Fix CISKubernetes 4.1.8:
# Ensure that the client certificate authorities file ownership is set to root:root
#
# Scope: run on every worker node as root.
# Safe to re-run (idempotent).

set -euo pipefail

echo "=== Detecting kubelet --client-ca-file on this node ==="

# Derive the client CA file path from the running kubelet process, if present.
CAFILE="$(ps -ef \
  | grep kubelet \
  | grep -v apiserver \
  | grep -- '--client-ca-file=' \
  | awk -F '--client-ca-file=' '{print $2}' \
  | awk '{print $1}' \
  | uniq \
  | head -n1 || true)"

# Fallback to default if not detected from process
if [ -z "${CAFILE}" ]; then
  CAFILE="/etc/kubernetes/pki/ca.crt"
  echo "No --client-ca-file flag detected; falling back to default: ${CAFILE}"
else
  echo "Detected --client-ca-file: ${CAFILE}"
fi

# If the file does not exist, report and exit non-zero for visibility
if [ ! -e "${CAFILE}" ]; then
  echo "ERROR: Client CA file does not exist: ${CAFILE}" >&2
  exit 1
fi

echo "=== Current ownership of ${CAFILE} ==="
stat -c '%n %U:%G %a' "${CAFILE}"

# Apply remediation: ensure owner and group are root:root
echo "=== Setting ownership to root:root on ${CAFILE} ==="
chown root:root "${CAFILE}"

# Verification (adapted from audit command)
echo "=== Verifying ownership of client CA file ==="
OWNERSHIP="$(stat -c '%U:%G' "${CAFILE}")"
echo "Ownership after change: ${OWNERSHIP}"

if [ "${OWNERSHIP}" = "root:root" ]; then
  echo "SUCCESS: ${CAFILE} is owned by root:root"
  exit 0
else
  echo "FAILURE: ${CAFILE} ownership is not root:root (got ${OWNERSHIP})" >&2
  exit 1
fi

Usage (on every worker node, as root):

chmod +x /usr/local/sbin/fix-kubelet-client-ca-ownership.sh
/usr/local/sbin/fix-kubelet-client-ca-ownership.sh

Kubernetes

Kubernetes Misconfigurations

Ensure Client Certificate Authorities File Ownership Is Root

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading: