> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# If Proxy Kubeconfig File Exists Ensure Ownership Is Root

### More Info:

If kube-proxy is running, ensure that the file ownership of its kubeconfig file is set to root:root.

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, confirm the kube-proxy kubeconfig file path (your affected file is `/var/lib/kube-proxy/config.conf`):
           ```bash theme={null}
           ls -l /var/lib/kube-proxy/config.conf
           ```

        2. On every worker node, set the file owner and group to `root:root`:
           ```bash theme={null}
           sudo chown root:root /var/lib/kube-proxy/config.conf
           ```

        3. (Optional, but recommended) On every worker node, restrict permissions so only root can read/write:
           ```bash theme={null}
           sudo chmod 600 /var/lib/kube-proxy/config.conf
           ```

        4. On every worker node, verify the ownership is now `root:root`:
           ```bash theme={null}
           stat -c %U:%G /var/lib/kube-proxy/config.conf
           ```
           The command must output:
           ```text theme={null}
           root:root
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file ownership on worker node filesystems, including `/var/lib/kube-proxy/config.conf`, so this finding cannot be fixed via the Kubernetes API. Perform the correction directly on each worker node’s host OS as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediation for:
        # "If Proxy Kubeconfig File Exists Ensure Ownership Is Root" (CIS Kubernetes 4.1.4)
        #
        # Scope: Run on every worker node.
        # Action: If /var/lib/kube-proxy/config.conf exists, set ownership to root:root.
        # Safe to re-run: yes (idempotent).

        set -euo pipefail

        TARGET_FILE="/var/lib/kube-proxy/config.conf"

        echo "=== CIS 4.1.4: Ensure kube-proxy kubeconfig ownership is root:root ==="
        echo "Node: $(hostname -f || hostname)"

        if [ ! -e "$TARGET_FILE" ]; then
          echo "Target file does not exist on this node: $TARGET_FILE"
          echo "Nothing to change."
        else
          echo "Found kube-proxy config: $TARGET_FILE"

          current_owner_group=$(stat -c '%U:%G' "$TARGET_FILE")
          echo "Current ownership: $current_owner_group"

          if [ "$current_owner_group" != "root:root" ]; then
            echo "Updating ownership to root:root ..."
            chown root:root "$TARGET_FILE"
          else
            echo "Ownership already set to root:root; no change needed."
          fi

          # Verification (adapted from audit)
          echo "Verifying ownership ..."
          verified_owner_group=$(stat -c '%U:%G' "$TARGET_FILE")
          echo "Verified ownership: $verified_owner_group"

          if [ "$verified_owner_group" != "root:root" ]; then
            echo "ERROR: Failed to set ownership on $TARGET_FILE (expected root:root)" >&2
            exit 1
          fi

          echo "SUCCESS: $TARGET_FILE ownership is correctly set to root:root"
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kube-proxy/](https://kubernetes.io/docs/admin/kube-proxy/)