> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubelet Service File Permissions Are Restrictive

### More Info:

Ensure that the kubelet service file has permissions of 644 or more restrictive

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check the current permissions of the kubelet service file:
           ```sh theme={null}
           stat -c permissions=%a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```

        2. On every worker node, set the permissions to 644 (owner read/write, group read, others read):
           ```sh theme={null}
           chmod 644 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```

        3. (Optional but recommended) Confirm ownership is root:root to avoid unexpected access:
           ```sh theme={null}
           chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```

        4. On every worker node, reload systemd so it recognizes any unit file permission/metadata changes:
           ```sh theme={null}
           systemctl daemon-reload
           ```

        5. Verify the permissions are now compliant on every worker node:
           ```sh theme={null}
           stat -c permissions=%a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```
           The output must show:
           ```text theme={null}
           permissions=644
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify host-level systemd unit files such as `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on worker nodes. To remediate this finding, you must change file permissions directly on each worker node over SSH; see the Manual Steps section for the exact commands.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Harden kubelet systemd drop-in permissions (CIS 4.1.1)
        # Targets: every worker node
        # Idempotent: safe to run multiple times

        set -euo pipefail

        TARGET_FILE="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
        DESIRED_MODE="644"

        echo "==> Checking kubelet service drop-in: ${TARGET_FILE}"

        if [ ! -e "${TARGET_FILE}" ]; then
          echo "File not found: ${TARGET_FILE}"
          echo "Nothing to change on this node."
          exit 0
        fi

        current_mode="$(stat -c '%a' "${TARGET_FILE}")"

        if [ "${current_mode}" != "${DESIRED_MODE}" ]; then
          echo "Current mode is ${current_mode}, setting to ${DESIRED_MODE}"
          chmod "${DESIRED_MODE}" "${TARGET_FILE}"
        else
          echo "Permissions already set to ${DESIRED_MODE}, no change needed."
        fi

        echo "==> Verifying permissions"
        audit_output="$(stat -c permissions=%a "${TARGET_FILE}")"
        echo "${audit_output}"

        if [ "${audit_output}" != "permissions=${DESIRED_MODE}" ]; then
          echo "ERROR: permission verification failed; expected permissions=${DESIRED_MODE}" >&2
          exit 1
        fi

        echo "Permissions successfully set to ${DESIRED_MODE} on ${TARGET_FILE}"
        ```

        Usage:

        * Copy this script to a file, e.g. `/usr/local/sbin/fix-kubelet-perms.sh`.
        * Make it executable:
          ```bash theme={null}
          chmod 700 /usr/local/sbin/fix-kubelet-perms.sh
          ```
        * Run on every worker node:
          ```bash theme={null}
          sudo /usr/local/sbin/fix-kubelet-perms.sh
          ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kubelet/](https://kubernetes.io/docs/admin/kubelet/)