> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Etcd Pod Specification File Permissions Are Restrictive

### More Info:

Ensure that the /etc/kubernetes/manifests/etcd.yaml file has permissions of 644 or more restrictive.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, check the current permissions of the etcd manifest file:
           ```bash theme={null}
           sudo stat -c 'permissions=%a  file=%n' /etc/kubernetes/manifests/etcd.yaml
           ```

        2. If the permissions are more permissive than 644 (e.g., 664, 666, 777), restrict them:
           ```bash theme={null}
           sudo chmod 644 /etc/kubernetes/manifests/etcd.yaml
           ```

        3. Confirm the new permissions are correctly set (this does not restart etcd; the static pod manifest is only read for pod config, not file mode):
           ```bash theme={null}
           sudo stat -c 'permissions=%a  file=%n' /etc/kubernetes/manifests/etcd.yaml
           ```

        4. Re-run the benchmark audit command to verify compliance:
           ```bash theme={null}
           /bin/sh -c 'if test -e /etc/kubernetes/manifests/etcd.yaml; then find /etc/kubernetes/manifests/etcd.yaml -name "*etcd*" | xargs stat -c permissions=%a; fi'
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on the control plane node, including `/etc/kubernetes/manifests/etcd.yaml`. To remediate this finding you must change the file mode directly on every control plane node (see the Manual Steps section).
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediate CIS Kubernetes 1.1.7:
        # Ensure /etc/kubernetes/manifests/etcd.yaml permissions are 644 or more restrictive.
        #
        # Run on: every control plane node
        # Usage: sudo /root/fix_etcd_manifest_perms.sh

        set -euo pipefail

        ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"
        TARGET_MODE="644"

        echo "==> Checking for ${ETCD_MANIFEST}"
        if [ ! -e "${ETCD_MANIFEST}" ]; then
          echo "File ${ETCD_MANIFEST} does not exist on this node; nothing to do."
          exit 0
        fi

        # Get current mode in numeric form (e.g. 640, 644, 600)
        CURRENT_MODE="$(stat -c '%a' "${ETCD_MANIFEST}")"

        echo "Current permissions: ${CURRENT_MODE}"
        echo "Target permissions : ${TARGET_MODE}"

        if [ "${CURRENT_MODE}" != "${TARGET_MODE}" ]; then
          echo "Updating permissions on ${ETCD_MANIFEST} to ${TARGET_MODE}"
          chmod "${TARGET_MODE}" "${ETCD_MANIFEST}"
        else
          echo "Permissions already set to ${TARGET_MODE}; no change needed."
        fi

        # Verification (from the benchmark audit command)
        echo "==> Verifying result"
        if test -e "${ETCD_MANIFEST}"; then
          /bin/sh -c "find ${ETCD_MANIFEST} -name '*etcd*' | xargs stat -c permissions=%a"
        fi

        # Final check to ensure compliance (exit non-zero if not compliant)
        FINAL_MODE="$(stat -c '%a' "${ETCD_MANIFEST}")"
        if [ "${FINAL_MODE}" != "${TARGET_MODE}" ]; then
          echo "ERROR: Expected permissions ${TARGET_MODE}, but found ${FINAL_MODE} after remediation." >&2
          exit 1
        fi

        echo "Remediation successful: ${ETCD_MANIFEST} permissions are ${FINAL_MODE}."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/etcd/](https://kubernetes.io/docs/admin/etcd/)