Skip to main content

Ensure Etcd Data Directory Permissions Are Restrictive

More Info:​

Ensure that the etcd data directory has permissions of 700 or more restrictive.

Risk Level​

High

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, identify the etcd data directory:

    ps -ef | grep etcd | grep -- --data-dir

    Note the value passed to --data-dir (for example /var/lib/etcd or /var/lib/etcd/default.etcd).

  2. If no --data-dir is visible from the process (for example, etcd not currently running), inspect the static pod manifest to find it:

    sudo cat /etc/kubernetes/manifests/etcd.yaml | grep -A2 -- '--data-dir'

  3. On the same control plane node, ensure the directory exists and has restrictive permissions (replace /var/lib/etcd with the directory you found):

    sudo test -d /var/lib/etcd || sudo mkdir -p /var/lib/etcd
    sudo chmod 700 /var/lib/etcd

  4. (Optional but recommended) Confirm the directory owner is the user running etcd (commonly etcd or root); adjust if needed, replacing etcd and the directory as appropriate:

    ps -ef | grep etcd | grep -v grep
    stat /var/lib/etcd
    sudo chown etcd:etcd /var/lib/etcd

  5. Repeat steps 1–4 on every control plane node.

  6. Verification (run on every control plane node):

    DATA_DIR=''
    for d in $(ps -ef | grep etcd | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
      if test -d "$d"; then DATA_DIR="$d"; fi
    done
    if ! test -d "$DATA_DIR"; then DATA_DIR=/var/lib/etcd/default.etcd; fi
    stat -c permissions=%a "$DATA_DIR"

    Confirm the output shows permissions=700 (or a more restrictive value like 600).

Using kubectl

kubectl cannot modify filesystem permissions on the etcd data directory or edit host-level files like /etc/kubernetes/manifests/etcd.yaml; this must be corrected directly on each control plane node via SSH. Refer to the Manual Steps section for the exact host-level commands to set the etcd data directory to mode 700 or more restrictive.

Automation
#!/usr/bin/env bash
# Purpose: Ensure etcd data directory permissions are 700 or more restrictive
# Scope:   Run on every control plane node
# Safe:    Idempotent; can be re-run

set -euo pipefail

echo "=== Detecting etcd data directory on this node ==="

DATA_DIR=""

# Try to discover the etcd data directory from running processes
for d in $(ps -ef | grep '[e]tcd' | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
  if [ -d "$d" ]; then
    DATA_DIR="$d"
  fi
done

# Fallback to default if nothing discovered
if [ -z "$DATA_DIR" ]; then
  DEFAULT_DIR="/var/lib/etcd/default.etcd"
  if [ -d "$DEFAULT_DIR" ]; then
    DATA_DIR="$DEFAULT_DIR"
  fi
fi

if [ -z "$DATA_DIR" ]; then
  echo "ERROR: Could not determine etcd data directory. Is this a control plane node with etcd running?"
  exit 1
fi

echo "Using etcd data directory: $DATA_DIR"

if [ ! -d "$DATA_DIR" ]; then
  echo "ERROR: Detected etcd data directory does not exist: $DATA_DIR"
  exit 1
fi

echo "=== Current permissions ==="
stat -c 'path=%n permissions=%a owner=%U group=%G' "$DATA_DIR"

echo "=== Applying restrictive permissions (700) to etcd data directory ==="
chmod 700 "$DATA_DIR"

echo "=== Verifying permissions ==="
PERMS="$(stat -c '%a' "$DATA_DIR")"
echo "Final permissions on $DATA_DIR: $PERMS"

if [ "$PERMS" -le 700 ]; then
  echo "SUCCESS: etcd data directory permissions are 700 or more restrictive."
  exit 0
else
  echo "FAIL: etcd data directory permissions are not restrictive enough (got $PERMS, expected <= 700)."
  exit 2
fi

Additional Reading:​