> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# If Proxy Kubeconfig File Exists Ensure Permissions Are Restrictive

### More Info:

If kube-proxy is running, and if it is using a file-based kubeconfig file, ensure that the proxy kubeconfig file has permissions of 644 or more restrictive.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, identify the kube-proxy kubeconfig file actually in use (if kube-proxy is a static pod, this will typically be referenced in its manifest):
           ```bash theme={null}
           sudo grep -R --no-color -n "kubeconfig" /etc/kubernetes /var/lib/kube-proxy 2>/dev/null
           ```
           If your environment specifies `/var/lib/kube-proxy/config.conf`, proceed with that path.

        2. On every worker node, review current ownership and permissions of the kube-proxy kubeconfig:
           ```bash theme={null}
           sudo stat -c 'file=%n owner=%U group=%G perms=%a' /var/lib/kube-proxy/config.conf
           ```

        3. On every worker node, decide whether it is acceptable for all local users to have read access to this file (since mode 644 allows group/other read). If this node hosts untrusted local users or processes, you may choose a more restrictive mode such as `640` or `600` instead of `644`.

        4. On every worker node, set permissions on the kube-proxy kubeconfig file to 644 or more restrictive (adjust the mode if you decided on stricter permissions in step 3):
           ```bash theme={null}
           sudo chmod 644 /var/lib/kube-proxy/config.conf
           ```

        5. (Optional hardening) On every worker node, ensure the file is owned by root (or the service account user running kube-proxy, if different in your environment):
           ```bash theme={null}
           sudo chown root:root /var/lib/kube-proxy/config.conf
           ```

        6. On every worker node, verify the permissions are now 644 or more restrictive:
           ```bash theme={null}
           sudo stat -c 'permissions=%a file=%n' /var/lib/kube-proxy/config.conf
           ```
           Confirm the reported permissions are `644`, `640`, `600`, or another value numerically less permissive than `644`.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on worker nodes, so it cannot be used to fix this finding on `/var/lib/kube-proxy/config.conf`. To remediate, you must adjust the file permissions directly on each worker node’s filesystem; follow the guidance in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Harden kube-proxy kubeconfig permissions on every worker node.
        # Usage:
        #   1) Put all worker node hostnames/IPs into /root/worker-nodes.txt on a machine
        #      that has SSH access to them (e.g., bastion/jump host).
        #   2) Run this script on that bastion/jump host.
        #
        # Notes:
        # - Idempotent: safe to run multiple times.
        # - Only changes permissions if the file exists on the worker node.

        set -euo pipefail

        WORKER_LIST_FILE="/root/worker-nodes.txt"
        REMOTE_FILE="/var/lib/kube-proxy/config.conf"
        SSH_OPTS="-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5"

        if [[ ! -f "${WORKER_LIST_FILE}" ]]; then
          echo "Worker node list file not found: ${WORKER_LIST_FILE}" >&2
          exit 1
        fi

        echo "Starting kube-proxy kubeconfig permission hardening..."
        echo "Target file on worker nodes: ${REMOTE_FILE}"
        echo

        while IFS= read -r NODE || [[ -n "$NODE" ]]; do
          # Skip empty or commented lines
          [[ -z "$NODE" || "$NODE" =~ ^# ]] && continue

          echo "=== Node: ${NODE} ==="

          # Check if the file exists
          if ! ssh ${SSH_OPTS} "root@${NODE}" "test -e '${REMOTE_FILE}'"; then
            echo "  File not found: ${REMOTE_FILE} (skipping)"
            echo
            continue
          fi

          # Get current permissions
          CURRENT_PERMS=$(ssh ${SSH_OPTS} "root@${NODE}" "stat -c '%a' '${REMOTE_FILE}'" || echo "unknown")

          if [[ "${CURRENT_PERMS}" != "unknown" ]]; then
            echo "  Current permissions: ${CURRENT_PERMS}"
          else
            echo "  Could not read current permissions; continuing with chmod"
          fi

          # Apply chmod 644 (idempotent)
          ssh ${SSH_OPTS} "root@${NODE}" "chmod 644 '${REMOTE_FILE}'"

          # Verify
          NEW_PERMS=$(ssh ${SSH_OPTS} "root@${NODE}" "stat -c '%a' '${REMOTE_FILE}'")
          echo "  New permissions: ${NEW_PERMS}"

          if [[ "${NEW_PERMS}" -gt 644 ]]; then
            echo "  WARNING: Permissions are more permissive than 644 after change." >&2
            echo "           Investigate manually on ${NODE} for ${REMOTE_FILE}." >&2
          fi

          echo
        done < "${WORKER_LIST_FILE}"

        echo "Verification summary:"
        echo "Re-running audit on each node to confirm permissions are 644 or more restrictive."
        echo

        while IFS= read -r NODE || [[ -n "$NODE" ]]; do
          [[ -z "$NODE" || "$NODE" =~ ^# ]] && continue

          echo "--- Node: ${NODE} ---"
          ssh ${SSH_OPTS} "root@${NODE}" "/bin/sh -c 'if test -e \"${REMOTE_FILE}\"; then stat -c permissions=%a \"${REMOTE_FILE}\"; else echo \"${REMOTE_FILE} not present\"; fi'"
          echo
        done < "${WORKER_LIST_FILE}"

        echo "Completed."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kube-proxy/](https://kubernetes.io/docs/admin/kube-proxy/)