> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubeconfig Kubelet Conf File Ownership Is Root

### More Info:

Ensure that the kubelet.conf file ownership is set to root:root.

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check the current ownership of the kubelet kubeconfig file:
           ```bash theme={null}
           stat -c %U:%G /etc/kubernetes/kubelet.conf
           ```

        2. If the ownership is not `root:root`, change it on that worker node:
           ```bash theme={null}
           chown root:root /etc/kubernetes/kubelet.conf
           ```

        3. Confirm the ownership is now correct on that worker node:
           ```bash theme={null}
           stat -c %U:%G /etc/kubernetes/kubelet.conf
           ```
           The output must be:
           ```text theme={null}
           root:root
           ```

        4. Repeat steps 1–3 on every worker node in the cluster.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change file ownership on the worker node filesystem, so this finding cannot be remediated via the Kubernetes API. The fix must be applied directly on every worker node’s OS (host-level) by adjusting `/etc/kubernetes/kubelet.conf` ownership; see the Manual Steps section for the exact commands.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Automation: Ensure /etc/kubernetes/kubelet.conf is owned by root:root
        # Scope: Run on every worker node
        # Safe to re-run; only adjusts ownership if needed.

        set -euo pipefail

        KUBELET_CONF="/etc/kubernetes/kubelet.conf"

        echo "=== [INFO] Checking for ${KUBELET_CONF} ==="
        if [[ ! -e "${KUBELET_CONF}" ]]; then
          echo "=== [WARN] ${KUBELET_CONF} not found on this node, nothing to do."
          exit 0
        fi

        current_owner_group="$(stat -c '%U:%G' "${KUBELET_CONF}")"
        echo "=== [INFO] Current ownership: ${current_owner_group}"

        if [[ "${current_owner_group}" != "root:root" ]]; then
          echo "=== [INFO] Changing ownership to root:root"
          chown root:root "${KUBELET_CONF}"
        else
          echo "=== [INFO] Ownership already root:root, no change needed."
        fi

        echo "=== [INFO] Verifying remediation ==="
        /bin/sh -c 'if test -e /etc/kubernetes/kubelet.conf; then stat -c %U:%G /etc/kubernetes/kubelet.conf; fi'

        verified_owner_group="$(stat -c '%U:%G' "${KUBELET_CONF}")"
        if [[ "${verified_owner_group}" != "root:root" ]]; then
          echo "=== [ERROR] Verification failed: expected root:root, got ${verified_owner_group}"
          exit 1
        fi

        echo "=== [OK] kubelet.conf ownership is correctly set to root:root ==="
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kubelet/](https://kubernetes.io/docs/admin/kubelet/)