Skip to main content

Ensure Kubelet Service File Permissions Are Restrictive

More Info:​

Ensure that the kubelet service file has permissions of 644 or more restrictive

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check the current permissions of the kubelet service file:

    stat -c permissions=%a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

  2. On every worker node, set the permissions to 644 (owner read/write, group read, others read):

    chmod 644 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

  3. (Optional but recommended) Confirm ownership is root:root to avoid unexpected access:

    chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

  4. On every worker node, reload systemd so it recognizes any unit file permission/metadata changes:

    systemctl daemon-reload

  5. Verify the permissions are now compliant on every worker node:

    stat -c permissions=%a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

    The output must show:

    permissions=644
Using kubectl

kubectl cannot modify host-level systemd unit files such as /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on worker nodes. To remediate this finding, you must change file permissions directly on each worker node over SSH; see the Manual Steps section for the exact commands.

Automation
#!/usr/bin/env bash
#
# Harden kubelet systemd drop-in permissions (CIS 4.1.1)
# Targets: every worker node
# Idempotent: safe to run multiple times

set -euo pipefail

TARGET_FILE="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
DESIRED_MODE="644"

echo "==> Checking kubelet service drop-in: ${TARGET_FILE}"

if [ ! -e "${TARGET_FILE}" ]; then
  echo "File not found: ${TARGET_FILE}"
  echo "Nothing to change on this node."
  exit 0
fi

current_mode="$(stat -c '%a' "${TARGET_FILE}")"

if [ "${current_mode}" != "${DESIRED_MODE}" ]; then
  echo "Current mode is ${current_mode}, setting to ${DESIRED_MODE}"
  chmod "${DESIRED_MODE}" "${TARGET_FILE}"
else
  echo "Permissions already set to ${DESIRED_MODE}, no change needed."
fi

echo "==> Verifying permissions"
audit_output="$(stat -c permissions=%a "${TARGET_FILE}")"
echo "${audit_output}"

if [ "${audit_output}" != "permissions=${DESIRED_MODE}" ]; then
  echo "ERROR: permission verification failed; expected permissions=${DESIRED_MODE}" >&2
  exit 1
fi

echo "Permissions successfully set to ${DESIRED_MODE} on ${TARGET_FILE}"

Usage:

  • Copy this script to a file, e.g. /usr/local/sbin/fix-kubelet-perms.sh.
  • Make it executable: 
    chmod 700 /usr/local/sbin/fix-kubelet-perms.sh
  • Run on every worker node: 
    sudo /usr/local/sbin/fix-kubelet-perms.sh

Additional Reading:​