> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Default Administrative Credential File Permissions Should Be 600

### More Info:

Verifies that admin.conf and super-admin.conf kubeconfig files have permissions of 600. These files grant cluster-admin access and must not be readable by other users.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, check the current permissions of the default admin kubeconfig files:
           ```bash theme={null}
           for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
             if test -e "$adminconf"; then
               stat -c "permissions=%a %n" "$adminconf"
             fi
           done
           ```

        2. On every control plane node, restrict permissions on `admin.conf` so only the owner can read and write it:
           ```bash theme={null}
           if test -e /etc/kubernetes/admin.conf; then
             chmod 600 /etc/kubernetes/admin.conf
           fi
           ```

        3. On every control plane node running Kubernetes 1.29 or later, also restrict permissions on `super-admin.conf` (if present):
           ```bash theme={null}
           if test -e /etc/kubernetes/super-admin.conf; then
             chmod 600 /etc/kubernetes/super-admin.conf
           fi
           ```

        4. On every control plane node, confirm that only the intended user (typically `root`) owns these files and that group/others do not have access:
           ```bash theme={null}
           for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
             if test -e "$adminconf"; then
               ls -l "$adminconf"
             fi
           done
           ```

        5. On every control plane node, re-run the permissions check to verify remediation:
           ```bash theme={null}
           for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
             if test -e "$adminconf"; then
               stat -c "permissions=%a %n" "$adminconf"
             fi
           done
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        `kubectl` cannot modify file permissions on control plane nodes, so it cannot be used to fix `/etc/kubernetes/admin.conf` or `/etc/kubernetes/super-admin.conf`. File mode changes must be made directly on each control plane node’s filesystem; see the Manual Steps section for the exact commands to run over SSH.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Fix CIS Kubernetes 1.1.13: ensure admin.conf and super-admin.conf are 600
        # Run on every control plane node (as root).

        set -euo pipefail

        ADMIN_FILES=(
          "/etc/kubernetes/admin.conf"
          "/etc/kubernetes/super-admin.conf"
        )

        changed=0

        echo "==> Ensuring permissions 600 on default administrative kubeconfig files"

        for f in "${ADMIN_FILES[@]}"; do
          if [ -e "$f" ]; then
            current_perm=$(stat -c "%a" "$f")
            if [ "$current_perm" != "600" ]; then
              echo " - Updating $f permissions from $current_perm to 600"
              chmod 600 "$f"
              changed=1
            else
              echo " - $f already has permissions 600"
            fi
          else
            echo " - $f does not exist on this node, skipping"
          fi
        done

        echo
        echo "==> Verifying resulting permissions"
        for f in "${ADMIN_FILES[@]}"; do
          if [ -e "$f" ]; then
            stat -c "permissions=%a %n" "$f"
          fi
        done

        if [ "$changed" -eq 0 ]; then
          echo "==> No changes were necessary; all existing files already compliant."
        else
          echo "==> Permissions updated where necessary."
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>