Ensure Etcd Data Directory Permissions Are Restrictive

Manual Steps

On every control plane node, identify the etcd data directory:
ps -ef | grep etcd | grep -- --data-dir
Note the value passed to --data-dir (for example /var/lib/etcd or /var/lib/etcd/default.etcd).
If no --data-dir is visible from the process (for example, etcd not currently running), inspect the static pod manifest to find it:
sudo cat /etc/kubernetes/manifests/etcd.yaml | grep -A2 -- '--data-dir'
On the same control plane node, ensure the directory exists and has restrictive permissions (replace /var/lib/etcd with the directory you found):
sudo test -d /var/lib/etcd || sudo mkdir -p /var/lib/etcd sudo chmod 700 /var/lib/etcd
(Optional but recommended) Confirm the directory owner is the user running etcd (commonly etcd or root); adjust if needed, replacing etcd and the directory as appropriate:
ps -ef | grep etcd | grep -v grep stat /var/lib/etcd sudo chown etcd:etcd /var/lib/etcd
Repeat steps 1–4 on every control plane node.

Verification (run on every control plane node):

DATA_DIR=''
for d in $(ps -ef | grep etcd | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
  if test -d "$d"; then DATA_DIR="$d"; fi
done
if ! test -d "$DATA_DIR"; then DATA_DIR=/var/lib/etcd/default.etcd; fi
stat -c permissions=%a "$DATA_DIR"

Confirm the output shows permissions=700 (or a more restrictive value like 600).

Using kubectl

kubectl cannot modify filesystem permissions on the etcd data directory or edit host-level files like /etc/kubernetes/manifests/etcd.yaml; this must be corrected directly on each control plane node via SSH. Refer to the Manual Steps section for the exact host-level commands to set the etcd data directory to mode 700 or more restrictive.

Automation

#!/usr/bin/env bash
# Purpose: Ensure etcd data directory permissions are 700 or more restrictive
# Scope:   Run on every control plane node
# Safe:    Idempotent; can be re-run

set -euo pipefail

echo "=== Detecting etcd data directory on this node ==="

DATA_DIR=""

# Try to discover the etcd data directory from running processes
for d in $(ps -ef | grep '[e]tcd' | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
  if [ -d "$d" ]; then
    DATA_DIR="$d"
  fi
done

# Fallback to default if nothing discovered
if [ -z "$DATA_DIR" ]; then
  DEFAULT_DIR="/var/lib/etcd/default.etcd"
  if [ -d "$DEFAULT_DIR" ]; then
    DATA_DIR="$DEFAULT_DIR"
  fi
fi

if [ -z "$DATA_DIR" ]; then
  echo "ERROR: Could not determine etcd data directory. Is this a control plane node with etcd running?"
  exit 1
fi

echo "Using etcd data directory: $DATA_DIR"

if [ ! -d "$DATA_DIR" ]; then
  echo "ERROR: Detected etcd data directory does not exist: $DATA_DIR"
  exit 1
fi

echo "=== Current permissions ==="
stat -c 'path=%n permissions=%a owner=%U group=%G' "$DATA_DIR"

echo "=== Applying restrictive permissions (700) to etcd data directory ==="
chmod 700 "$DATA_DIR"

echo "=== Verifying permissions ==="
PERMS="$(stat -c '%a' "$DATA_DIR")"
echo "Final permissions on $DATA_DIR: $PERMS"

if [ "$PERMS" -le 700 ]; then
  echo "SUCCESS: etcd data directory permissions are 700 or more restrictive."
  exit 0
else
  echo "FAIL: etcd data directory permissions are not restrictive enough (got $PERMS, expected <= 700)."
  exit 2
fi

Kubernetes

Kubernetes Misconfigurations

Ensure Etcd Data Directory Permissions Are Restrictive

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading: