Ensure Kubeconfig Kubelet Conf File Permissions Are Restrictive

Manual Steps

On every worker node, check the current permissions of the kubelet kubeconfig file:
stat -c permissions=%a /etc/kubernetes/kubelet.conf
On every worker node, set restrictive permissions (644) on the kubelet kubeconfig file:
chmod 644 /etc/kubernetes/kubelet.conf
(Optional) On every worker node, set the file owner and group to root if needed:
chown root:root /etc/kubernetes/kubelet.conf
On every worker node, verify the permissions are now correct:
stat -c permissions=%a /etc/kubernetes/kubelet.conf

Using kubectl

kubectl cannot modify file permissions on worker node files such as /etc/kubernetes/kubelet.conf; this must be fixed directly on each worker node’s host OS. Please follow the guidance in the Manual Steps section to update the file permissions and verify the fix.

Automation

#!/usr/bin/env bash
#
# Purpose: Ensure /etc/kubernetes/kubelet.conf permissions are 644 or more restrictive
# Scope:   Run on every worker node (or via SSH/Ansible across all worker nodes)
# Safe:    Idempotent; can be re-run any number of times

set -euo pipefail

KUBELET_CONF="/etc/kubernetes/kubelet.conf"
DESIRED_MODE="644"

echo "[$(hostname)] Checking ${KUBELET_CONF} ..."

if [ ! -e "${KUBELET_CONF}" ]; then
  echo "[$(hostname)] ${KUBELET_CONF} not present; nothing to change."
  exit 0
fi

# Get current permissions (numeric)
CURRENT_MODE="$(stat -c '%a' "${KUBELET_CONF}")"

echo "[$(hostname)] Current mode: ${CURRENT_MODE}, desired: ${DESIRED_MODE}"

# Only relax permissions if more permissive than 644
# Numeric comparison: if CURRENT_MODE > 644, then enforce 644
if [ "${CURRENT_MODE}" -gt "${DESIRED_MODE}" ]; then
  echo "[$(hostname)] Mode is too permissive; setting to ${DESIRED_MODE}"
  chmod "${DESIRED_MODE}" "${KUBELET_CONF}"
else
  echo "[$(hostname)] Mode is already ${DESIRED_MODE} or more restrictive; no change needed."
fi

# Verification (same as audit)
echo "[$(hostname)] Verifying:"
/bin/sh -c "if test -e ${KUBELET_CONF}; then stat -c permissions=%a ${KUBELET_CONF;}; fi"

# Optional: strict verification check
FINAL_MODE="$(stat -c '%a' "${KUBELET_CONF}")"
if [ "${FINAL_MODE}" -gt "${DESIRED_MODE}" ]; then
  echo "[$(hostname)] ERROR: Permissions still too permissive: ${FINAL_MODE}" >&2
  exit 1
fi

echo "[$(hostname)] kubelet.conf permissions compliant: ${FINAL_MODE}"

Usage examples:

Manually on each worker node (SSH in, then):
sudo bash ./fix-kubelet-conf-perms.sh

From an admin machine with SSH access and a workers.txt file (one hostname/IP per line):

while read -r node; do
  echo "Running on ${node}..."
  scp fix-kubelet-conf-perms.sh "${node}:/tmp/"
  ssh "${node}" "sudo bash /tmp/fix-kubelet-conf-perms.sh"
done < workers.txt

Kubernetes

Kubernetes Misconfigurations

Ensure Kubeconfig Kubelet Conf File Permissions Are Restrictive

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading: