> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubeconfig Kubelet Conf File Permissions Are Restrictive

### More Info:

Ensure that the kubelet.conf file has permissions of 644 or more restrictive

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check the current permissions of the kubelet kubeconfig file:
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/kubelet.conf
           ```

        2. On every worker node, set restrictive permissions (644) on the kubelet kubeconfig file:
           ```bash theme={null}
           chmod 644 /etc/kubernetes/kubelet.conf
           ```

        3. (Optional) On every worker node, set the file owner and group to root if needed:
           ```bash theme={null}
           chown root:root /etc/kubernetes/kubelet.conf
           ```

        4. On every worker node, verify the permissions are now correct:
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/kubelet.conf
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on worker node files such as `/etc/kubernetes/kubelet.conf`; this must be fixed directly on each worker node’s host OS. Please follow the guidance in the Manual Steps section to update the file permissions and verify the fix.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Purpose: Ensure /etc/kubernetes/kubelet.conf permissions are 644 or more restrictive
        # Scope:   Run on every worker node (or via SSH/Ansible across all worker nodes)
        # Safe:    Idempotent; can be re-run any number of times

        set -euo pipefail

        KUBELET_CONF="/etc/kubernetes/kubelet.conf"
        DESIRED_MODE="644"

        echo "[$(hostname)] Checking ${KUBELET_CONF} ..."

        if [ ! -e "${KUBELET_CONF}" ]; then
          echo "[$(hostname)] ${KUBELET_CONF} not present; nothing to change."
          exit 0
        fi

        # Get current permissions (numeric)
        CURRENT_MODE="$(stat -c '%a' "${KUBELET_CONF}")"

        echo "[$(hostname)] Current mode: ${CURRENT_MODE}, desired: ${DESIRED_MODE}"

        # Only relax permissions if more permissive than 644
        # Numeric comparison: if CURRENT_MODE > 644, then enforce 644
        if [ "${CURRENT_MODE}" -gt "${DESIRED_MODE}" ]; then
          echo "[$(hostname)] Mode is too permissive; setting to ${DESIRED_MODE}"
          chmod "${DESIRED_MODE}" "${KUBELET_CONF}"
        else
          echo "[$(hostname)] Mode is already ${DESIRED_MODE} or more restrictive; no change needed."
        fi

        # Verification (same as audit)
        echo "[$(hostname)] Verifying:"
        /bin/sh -c "if test -e ${KUBELET_CONF}; then stat -c permissions=%a ${KUBELET_CONF;}; fi"

        # Optional: strict verification check
        FINAL_MODE="$(stat -c '%a' "${KUBELET_CONF}")"
        if [ "${FINAL_MODE}" -gt "${DESIRED_MODE}" ]; then
          echo "[$(hostname)] ERROR: Permissions still too permissive: ${FINAL_MODE}" >&2
          exit 1
        fi

        echo "[$(hostname)] kubelet.conf permissions compliant: ${FINAL_MODE}"
        ```

        Usage examples:

        * Manually on each worker node (SSH in, then):
          ```bash theme={null}
          sudo bash ./fix-kubelet-conf-perms.sh
          ```

        * From an admin machine with SSH access and a workers.txt file (one hostname/IP per line):
          ```bash theme={null}
          while read -r node; do
            echo "Running on ${node}..."
            scp fix-kubelet-conf-perms.sh "${node}:/tmp/"
            ssh "${node}" "sudo bash /tmp/fix-kubelet-conf-perms.sh"
          done < workers.txt
          ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kubelet/](https://kubernetes.io/docs/admin/kubelet/)