Skip to main content

Ensure Kubeconfig Kubelet Conf File Ownership Is Root

More Info:​

Ensure that the kubelet.conf file ownership is set to root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check the current ownership of the kubelet kubeconfig file:

    stat -c %U:%G /etc/kubernetes/kubelet.conf

  2. If the ownership is not root:root, change it on that worker node:

    chown root:root /etc/kubernetes/kubelet.conf

  3. Confirm the ownership is now correct on that worker node:

    stat -c %U:%G /etc/kubernetes/kubelet.conf

    The output must be:

    root:root

  4. Repeat steps 1–3 on every worker node in the cluster.

Using kubectl

kubectl cannot change file ownership on the worker node filesystem, so this finding cannot be remediated via the Kubernetes API. The fix must be applied directly on every worker node’s OS (host-level) by adjusting /etc/kubernetes/kubelet.conf ownership; see the Manual Steps section for the exact commands.

Automation
#!/usr/bin/env bash
#
# Automation: Ensure /etc/kubernetes/kubelet.conf is owned by root:root
# Scope: Run on every worker node
# Safe to re-run; only adjusts ownership if needed.

set -euo pipefail

KUBELET_CONF="/etc/kubernetes/kubelet.conf"

echo "=== [INFO] Checking for ${KUBELET_CONF} ==="
if [[ ! -e "${KUBELET_CONF}" ]]; then
  echo "=== [WARN] ${KUBELET_CONF} not found on this node, nothing to do."
  exit 0
fi

current_owner_group="$(stat -c '%U:%G' "${KUBELET_CONF}")"
echo "=== [INFO] Current ownership: ${current_owner_group}"

if [[ "${current_owner_group}" != "root:root" ]]; then
  echo "=== [INFO] Changing ownership to root:root"
  chown root:root "${KUBELET_CONF}"
else
  echo "=== [INFO] Ownership already root:root, no change needed."
fi

echo "=== [INFO] Verifying remediation ==="
/bin/sh -c 'if test -e /etc/kubernetes/kubelet.conf; then stat -c %U:%G /etc/kubernetes/kubelet.conf; fi'

verified_owner_group="$(stat -c '%U:%G' "${KUBELET_CONF}")"
if [[ "${verified_owner_group}" != "root:root" ]]; then
  echo "=== [ERROR] Verification failed: expected root:root, got ${verified_owner_group}"
  exit 1
fi

echo "=== [OK] kubelet.conf ownership is correctly set to root:root ==="

Additional Reading:​