> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Default Administrative Credential File Ownership Should Be root:root

### More Info:

Verifies that admin.conf and super-admin.conf kubeconfig files are owned by root:root so only privileged users can read the cluster-admin credentials.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, check current ownership of the admin kubeconfig files:

        ```bash theme={null}
        for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
          if test -e "$adminconf"; then
            stat -c "ownership=%U:%G %n" "$adminconf"
          fi
        done
        ```

        2. On every control plane node, change ownership of `/etc/kubernetes/admin.conf` to `root:root` if the file exists:

        ```bash theme={null}
        if test -e /etc/kubernetes/admin.conf; then
          chown root:root /etc/kubernetes/admin.conf
        fi
        ```

        3. On every control plane node, change ownership of `/etc/kubernetes/super-admin.conf` to `root:root` if the file exists (especially on Kubernetes v1.29+):

        ```bash theme={null}
        if test -e /etc/kubernetes/super-admin.conf; then
          chown root:root /etc/kubernetes/super-admin.conf
        fi
        ```

        4. Verify the fix on every control plane node:

        ```bash theme={null}
        for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
          if test -e "$adminconf"; then
            stat -c "ownership=%U:%G %n" "$adminconf"
          fi
        done
        ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file ownership on control plane hosts, so it cannot be used to fix `/etc/kubernetes/admin.conf` or `/etc/kubernetes/super-admin.conf`. Change ownership directly on every control plane node’s filesystem, as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediate CIS Kubernetes 1.1.14:
        # Ensure /etc/kubernetes/admin.conf and /etc/kubernetes/super-admin.conf
        # are owned by root:root on every control plane node.
        #
        # Run this script as root on each control plane node.
        set -euo pipefail

        FILES=(
          "/etc/kubernetes/admin.conf"
          "/etc/kubernetes/super-admin.conf"
        )

        changed=0

        echo "==> Ensuring ownership is root:root for default administrative kubeconfig files"

        for f in "${FILES[@]}"; do
          if [ -e "$f" ]; then
            # Get current ownership in user:group form
            current_owner="$(stat -c '%U:%G' "$f")"
            if [ "$current_owner" != "root:root" ]; then
              echo " - Fixing ownership on $f (was $current_owner, setting to root:root)"
              chown root:root "$f"
              changed=1
            else
              echo " - Ownership already correct on $f (root:root)"
            fi
          else
            echo " - File not present, skipping: $f"
          fi
        done

        if [ "$changed" -eq 0 ]; then
          echo "==> No changes were necessary."
        else
          echo "==> Ownership updated where required."
        fi

        echo
        echo "==> Verifying ownership:"
        for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
          if test -e "$adminconf"; then
            stat -c "ownership=%U:%G %n" "$adminconf"
          fi
        done
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>