> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubelet Service File Ownership Is Root

### More Info:

Ensure that the kubelet service file ownership is set to root:root.

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, confirm the kubelet drop-in file exists and see its current ownership:
           ```bash theme={null}
           ls -l /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```
           If you see `No such file or directory`, this check is not applicable on that node.

        2. On every worker node where the file exists, change its ownership to root:root:
           ```bash theme={null}
           sudo chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```

        3. (Optional but recommended) Reload systemd metadata on every worker node so it sees any permission changes:
           ```bash theme={null}
           sudo systemctl daemon-reload
           ```

        4. Verify on every worker node that the ownership is now correctly set to root:root:
           ```bash theme={null}
           /bin/sh -c "if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; else echo \"File not found\"; fi"
           ```
           The command must output:
           ```text theme={null}
           root:root
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify host-level systemd unit files such as `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on worker nodes. To remediate this finding, you must change file ownership directly on each worker node’s OS; see the Manual Steps section for the exact commands.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Purpose: Ensure kubelet service file ownership is root:root on all worker nodes
        # Target:  Every worker node (run this script on each worker node, as root)
        # Safe:    Idempotent; re-running will keep ownership at root:root

        set -euo pipefail

        KUBELET_UNIT_DIR="/etc/systemd/system/kubelet.service.d"
        KUBELET_UNIT_FILE="${KUBELET_UNIT_DIR}/10-kubeadm.conf"

        echo "==> Checking for kubelet service drop-in: ${KUBELET_UNIT_FILE}"

        if [[ ! -e "${KUBELET_UNIT_FILE}" ]]; then
          echo "File not found: ${KUBELET_UNIT_FILE}"
          echo "No changes made on this node."
          exit 0
        fi

        # Show current ownership
        current_owner_group="$(stat -c '%U:%G' "${KUBELET_UNIT_FILE}")"
        echo "Current ownership: ${current_owner_group}"

        # Change ownership only if needed
        if [[ "${current_owner_group}" != "root:root" ]]; then
          echo "Updating ownership to root:root ..."
          chown root:root "${KUBELET_UNIT_FILE}"
        else
          echo "Ownership already root:root, no change needed."
        fi

        # Verification (same logic as audit command)
        echo "==> Verifying ownership..."
        verified_owner_group="$(stat -c '%U:%G' "${KUBELET_UNIT_FILE}")"
        echo "Verified ownership: ${verified_owner_group}"

        if [[ "${verified_owner_group}" != "root:root" ]]; then
          echo "ERROR: Ownership is not root:root after remediation." >&2
          exit 1
        fi

        echo "Remediation successful on this node."
        ```

        Usage:

        1. Copy this script to each worker node, e.g. `/root/fix-kubelet-ownership.sh`.
        2. On each worker node, run:
           ```bash theme={null}
           chmod +x /root/fix-kubelet-ownership.sh
           sudo /root/fix-kubelet-ownership.sh
           ```
        3. Optionally, re-run the audit command on each worker node:
           ```bash theme={null}
           /bin/sh -c "if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; else echo \"File not found\"; fi"
           ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kubelet/](https://kubernetes.io/docs/admin/kubelet/)