Skip to main content

If Proxy Kubeconfig File Exists Ensure Ownership Is Root

More Info:​

If kube-proxy is running, ensure that the file ownership of its kubeconfig file is set to root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, confirm the kube-proxy kubeconfig file path (your affected file is /var/lib/kube-proxy/config.conf):

    ls -l /var/lib/kube-proxy/config.conf

  2. On every worker node, set the file owner and group to root:root:

    sudo chown root:root /var/lib/kube-proxy/config.conf

  3. (Optional, but recommended) On every worker node, restrict permissions so only root can read/write:

    sudo chmod 600 /var/lib/kube-proxy/config.conf

  4. On every worker node, verify the ownership is now root:root:

    stat -c %U:%G /var/lib/kube-proxy/config.conf

    The command must output:

    root:root
Using kubectl

kubectl cannot modify file ownership on worker node filesystems, including /var/lib/kube-proxy/config.conf, so this finding cannot be fixed via the Kubernetes API. Perform the correction directly on each worker node’s host OS as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
#
# Remediation for:
# "If Proxy Kubeconfig File Exists Ensure Ownership Is Root" (CIS Kubernetes 4.1.4)
#
# Scope: Run on every worker node.
# Action: If /var/lib/kube-proxy/config.conf exists, set ownership to root:root.
# Safe to re-run: yes (idempotent).

set -euo pipefail

TARGET_FILE="/var/lib/kube-proxy/config.conf"

echo "=== CIS 4.1.4: Ensure kube-proxy kubeconfig ownership is root:root ==="
echo "Node: $(hostname -f || hostname)"

if [ ! -e "$TARGET_FILE" ]; then
  echo "Target file does not exist on this node: $TARGET_FILE"
  echo "Nothing to change."
else
  echo "Found kube-proxy config: $TARGET_FILE"

  current_owner_group=$(stat -c '%U:%G' "$TARGET_FILE")
  echo "Current ownership: $current_owner_group"

  if [ "$current_owner_group" != "root:root" ]; then
    echo "Updating ownership to root:root ..."
    chown root:root "$TARGET_FILE"
  else
    echo "Ownership already set to root:root; no change needed."
  fi

  # Verification (adapted from audit)
  echo "Verifying ownership ..."
  verified_owner_group=$(stat -c '%U:%G' "$TARGET_FILE")
  echo "Verified ownership: $verified_owner_group"

  if [ "$verified_owner_group" != "root:root" ]; then
    echo "ERROR: Failed to set ownership on $TARGET_FILE (expected root:root)" >&2
    exit 1
  fi

  echo "SUCCESS: $TARGET_FILE ownership is correctly set to root:root"
fi

Additional Reading:​