> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Client Certificate Authorities File Ownership Is Root

### More Info:

Ensure that the certificate authorities file ownership is set to root:root.

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, identify the client CA file path used by kubelet:
           ```bash theme={null}
           CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
           if test -z "$CAFILE"; then CAFILE=/etc/kubernetes/pki/ca.crt; fi
           echo "$CAFILE"
           ```

        2. Review the file and confirm it is the correct client CA for your environment (to avoid changing ownership on an unintended file):
           ```bash theme={null}
           ls -l "$CAFILE"
           openssl x509 -in "$CAFILE" -text -noout 2>/dev/null || echo "Not a certificate file, verify manually"
           ```
           If this is not the expected CA, stop and determine the correct CA file before proceeding.

        3. Change the file ownership to root:root (only after confirming in step 2):
           ```bash theme={null}
           sudo chown root:root "$CAFILE"
           ```

        4. (Optional but recommended) Restrict permissions to read-only for root if compatible with your tooling:
           ```bash theme={null}
           sudo chmod 600 "$CAFILE"
           ```

        5. Verify the ownership is now root:root using the audit logic on the same worker node:
           ```bash theme={null}
           CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
           if test -z "$CAFILE"; then CAFILE=/etc/kubernetes/pki/ca.crt; fi
           if test -e "$CAFILE"; then stat -c %U:%G "$CAFILE"; fi
           ```
           Confirm the output is:
           ```text theme={null}
           root:root
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change file ownership on worker node filesystems, including the kubelet client CA file referenced by `/var/lib/kubelet/config.yaml`. To fix this finding you must adjust file ownership directly on every worker node at the host level; follow the guidance in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix CISKubernetes 4.1.8:
        # Ensure that the client certificate authorities file ownership is set to root:root
        #
        # Scope: run on every worker node as root.
        # Safe to re-run (idempotent).

        set -euo pipefail

        echo "=== Detecting kubelet --client-ca-file on this node ==="

        # Derive the client CA file path from the running kubelet process, if present.
        CAFILE="$(ps -ef \
          | grep kubelet \
          | grep -v apiserver \
          | grep -- '--client-ca-file=' \
          | awk -F '--client-ca-file=' '{print $2}' \
          | awk '{print $1}' \
          | uniq \
          | head -n1 || true)"

        # Fallback to default if not detected from process
        if [ -z "${CAFILE}" ]; then
          CAFILE="/etc/kubernetes/pki/ca.crt"
          echo "No --client-ca-file flag detected; falling back to default: ${CAFILE}"
        else
          echo "Detected --client-ca-file: ${CAFILE}"
        fi

        # If the file does not exist, report and exit non-zero for visibility
        if [ ! -e "${CAFILE}" ]; then
          echo "ERROR: Client CA file does not exist: ${CAFILE}" >&2
          exit 1
        fi

        echo "=== Current ownership of ${CAFILE} ==="
        stat -c '%n %U:%G %a' "${CAFILE}"

        # Apply remediation: ensure owner and group are root:root
        echo "=== Setting ownership to root:root on ${CAFILE} ==="
        chown root:root "${CAFILE}"

        # Verification (adapted from audit command)
        echo "=== Verifying ownership of client CA file ==="
        OWNERSHIP="$(stat -c '%U:%G' "${CAFILE}")"
        echo "Ownership after change: ${OWNERSHIP}"

        if [ "${OWNERSHIP}" = "root:root" ]; then
          echo "SUCCESS: ${CAFILE} is owned by root:root"
          exit 0
        else
          echo "FAILURE: ${CAFILE} ownership is not root:root (got ${OWNERSHIP})" >&2
          exit 1
        fi
        ```

        Usage (on every worker node, as root):

        ```bash theme={null}
        chmod +x /usr/local/sbin/fix-kubelet-client-ca-ownership.sh
        /usr/local/sbin/fix-kubelet-client-ca-ownership.sh
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/authentication/#x509-client-certs](https://kubernetes.io/docs/admin/authentication/#x509-client-certs)