Skip to main content

Ensure Kubelet Service File Ownership Is Root

More Info:​

Ensure that the kubelet service file ownership is set to root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, confirm the kubelet drop-in file exists and see its current ownership:

    ls -l /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

    If you see No such file or directory, this check is not applicable on that node.

  2. On every worker node where the file exists, change its ownership to root:root:

    sudo chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

  3. (Optional but recommended) Reload systemd metadata on every worker node so it sees any permission changes:

    sudo systemctl daemon-reload

  4. Verify on every worker node that the ownership is now correctly set to root:root:

    /bin/sh -c "if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; else echo \"File not found\"; fi"

    The command must output:

    root:root
Using kubectl

kubectl cannot modify host-level systemd unit files such as /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on worker nodes. To remediate this finding, you must change file ownership directly on each worker node’s OS; see the Manual Steps section for the exact commands.

Automation
#!/usr/bin/env bash
# Purpose: Ensure kubelet service file ownership is root:root on all worker nodes
# Target:  Every worker node (run this script on each worker node, as root)
# Safe:    Idempotent; re-running will keep ownership at root:root

set -euo pipefail

KUBELET_UNIT_DIR="/etc/systemd/system/kubelet.service.d"
KUBELET_UNIT_FILE="${KUBELET_UNIT_DIR}/10-kubeadm.conf"

echo "==> Checking for kubelet service drop-in: ${KUBELET_UNIT_FILE}"

if [[ ! -e "${KUBELET_UNIT_FILE}" ]]; then
  echo "File not found: ${KUBELET_UNIT_FILE}"
  echo "No changes made on this node."
  exit 0
fi

# Show current ownership
current_owner_group="$(stat -c '%U:%G' "${KUBELET_UNIT_FILE}")"
echo "Current ownership: ${current_owner_group}"

# Change ownership only if needed
if [[ "${current_owner_group}" != "root:root" ]]; then
  echo "Updating ownership to root:root ..."
  chown root:root "${KUBELET_UNIT_FILE}"
else
  echo "Ownership already root:root, no change needed."
fi

# Verification (same logic as audit command)
echo "==> Verifying ownership..."
verified_owner_group="$(stat -c '%U:%G' "${KUBELET_UNIT_FILE}")"
echo "Verified ownership: ${verified_owner_group}"

if [[ "${verified_owner_group}" != "root:root" ]]; then
  echo "ERROR: Ownership is not root:root after remediation." >&2
  exit 1
fi

echo "Remediation successful on this node."

Usage:

  1. Copy this script to each worker node, e.g. /root/fix-kubelet-ownership.sh.
  2. On each worker node, run: 
    chmod +x /root/fix-kubelet-ownership.sh
    sudo /root/fix-kubelet-ownership.sh
  3. Optionally, re-run the audit command on each worker node: 
    /bin/sh -c "if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; else echo \"File not found\"; fi"

Additional Reading:​