Skip to main content

Kubeconfig Kubelet Conf File Permissions Are Restrictive

More Info:​

Ensure that the kubelet.conf file has permissions of 644 or more restrictive

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check the current permissions of the kubelet kubeconfig file:

    stat -c permissions=%a /etc/kubernetes/kubelet.conf

  2. On every worker node, set restrictive permissions (644) on the kubelet kubeconfig file:

    chmod 644 /etc/kubernetes/kubelet.conf

  3. (Optional) On every worker node, set the file owner and group to root if needed:

    chown root:root /etc/kubernetes/kubelet.conf

  4. On every worker node, verify the permissions are now correct:

    stat -c permissions=%a /etc/kubernetes/kubelet.conf
Using kubectl

kubectl cannot modify file permissions on worker node files such as /etc/kubernetes/kubelet.conf; this must be fixed directly on each worker node’s host OS. Please follow the guidance in the Manual Steps section to update the file permissions and verify the fix.

Automation
#!/usr/bin/env bash
#
# Purpose: Ensure /etc/kubernetes/kubelet.conf permissions are 644 or more restrictive
# Scope:   Run on every worker node (or via SSH/Ansible across all worker nodes)
# Safe:    Idempotent; can be re-run any number of times

set -euo pipefail

KUBELET_CONF="/etc/kubernetes/kubelet.conf"
DESIRED_MODE="644"

echo "[$(hostname)] Checking ${KUBELET_CONF} ..."

if [ ! -e "${KUBELET_CONF}" ]; then
  echo "[$(hostname)] ${KUBELET_CONF} not present; nothing to change."
  exit 0
fi

# Get current permissions (numeric)
CURRENT_MODE="$(stat -c '%a' "${KUBELET_CONF}")"

echo "[$(hostname)] Current mode: ${CURRENT_MODE}, desired: ${DESIRED_MODE}"

# Only relax permissions if more permissive than 644
# Numeric comparison: if CURRENT_MODE > 644, then enforce 644
if [ "${CURRENT_MODE}" -gt "${DESIRED_MODE}" ]; then
  echo "[$(hostname)] Mode is too permissive; setting to ${DESIRED_MODE}"
  chmod "${DESIRED_MODE}" "${KUBELET_CONF}"
else
  echo "[$(hostname)] Mode is already ${DESIRED_MODE} or more restrictive; no change needed."
fi

# Verification (same as audit)
echo "[$(hostname)] Verifying:"
/bin/sh -c "if test -e ${KUBELET_CONF}; then stat -c permissions=%a ${KUBELET_CONF;}; fi"

# Optional: strict verification check
FINAL_MODE="$(stat -c '%a' "${KUBELET_CONF}")"
if [ "${FINAL_MODE}" -gt "${DESIRED_MODE}" ]; then
  echo "[$(hostname)] ERROR: Permissions still too permissive: ${FINAL_MODE}" >&2
  exit 1
fi

echo "[$(hostname)] kubelet.conf permissions compliant: ${FINAL_MODE}"

Usage examples:

  • Manually on each worker node (SSH in, then):

    sudo bash ./fix-kubelet-conf-perms.sh

  • From an admin machine with SSH access and a workers.txt file (one hostname/IP per line):

    while read -r node; do
      echo "Running on ${node}..."
      scp fix-kubelet-conf-perms.sh "${node}:/tmp/"
      ssh "${node}" "sudo bash /tmp/fix-kubelet-conf-perms.sh"
    done < workers.txt

Additional Reading:​