Skip to main content

Etcd Pod Specification File Permissions Are Restrictive

More Info:​

Ensure that the /etc/kubernetes/manifests/etcd.yaml file has permissions of 644 or more restrictive.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current permissions of the etcd manifest file:

    sudo stat -c 'permissions=%a  file=%n' /etc/kubernetes/manifests/etcd.yaml

  2. If the permissions are more permissive than 644 (e.g., 664, 666, 777), restrict them:

    sudo chmod 644 /etc/kubernetes/manifests/etcd.yaml

  3. Confirm the new permissions are correctly set (this does not restart etcd; the static pod manifest is only read for pod config, not file mode):

    sudo stat -c 'permissions=%a  file=%n' /etc/kubernetes/manifests/etcd.yaml

  4. Re-run the benchmark audit command to verify compliance:

    /bin/sh -c 'if test -e /etc/kubernetes/manifests/etcd.yaml; then find /etc/kubernetes/manifests/etcd.yaml -name "*etcd*" | xargs stat -c permissions=%a; fi'
Using kubectl

kubectl cannot modify file permissions on the control plane node, including /etc/kubernetes/manifests/etcd.yaml. To remediate this finding you must change the file mode directly on every control plane node (see the Manual Steps section).

Automation
#!/usr/bin/env bash
#
# Remediate CIS Kubernetes 1.1.7:
# Ensure /etc/kubernetes/manifests/etcd.yaml permissions are 644 or more restrictive.
#
# Run on: every control plane node
# Usage: sudo /root/fix_etcd_manifest_perms.sh

set -euo pipefail

ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"
TARGET_MODE="644"

echo "==> Checking for ${ETCD_MANIFEST}"
if [ ! -e "${ETCD_MANIFEST}" ]; then
  echo "File ${ETCD_MANIFEST} does not exist on this node; nothing to do."
  exit 0
fi

# Get current mode in numeric form (e.g. 640, 644, 600)
CURRENT_MODE="$(stat -c '%a' "${ETCD_MANIFEST}")"

echo "Current permissions: ${CURRENT_MODE}"
echo "Target permissions : ${TARGET_MODE}"

if [ "${CURRENT_MODE}" != "${TARGET_MODE}" ]; then
  echo "Updating permissions on ${ETCD_MANIFEST} to ${TARGET_MODE}"
  chmod "${TARGET_MODE}" "${ETCD_MANIFEST}"
else
  echo "Permissions already set to ${TARGET_MODE}; no change needed."
fi

# Verification (from the benchmark audit command)
echo "==> Verifying result"
if test -e "${ETCD_MANIFEST}"; then
  /bin/sh -c "find ${ETCD_MANIFEST} -name '*etcd*' | xargs stat -c permissions=%a"
fi

# Final check to ensure compliance (exit non-zero if not compliant)
FINAL_MODE="$(stat -c '%a' "${ETCD_MANIFEST}")"
if [ "${FINAL_MODE}" != "${TARGET_MODE}" ]; then
  echo "ERROR: Expected permissions ${TARGET_MODE}, but found ${FINAL_MODE} after remediation." >&2
  exit 1
fi

echo "Remediation successful: ${ETCD_MANIFEST} permissions are ${FINAL_MODE}."

Additional Reading:​