> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API Server Pod Specification File Ownership Should Be root:root

### More Info:

Verifies that the kube-apiserver pod manifest file is owned by root:root. Correct ownership ensures only privileged users can modify control plane configuration.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, confirm the kube-apiserver manifest file exists and note its current ownership:
           ```bash theme={null}
           sudo ls -l /etc/kubernetes/manifests/kube-apiserver.yaml
           ```

        2. On every control plane node, change the file owner and group to root:root:
           ```bash theme={null}
           sudo chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml
           ```

        3. (Optional) Confirm file permissions are still appropriate (read-only change, no restart impact):
           ```bash theme={null}
           sudo stat -c 'File: %n  Owner: %U  Group: %G  Mode: %a' /etc/kubernetes/manifests/kube-apiserver.yaml
           ```

        4. Verify the fix on every control plane node using the audit command:
           ```bash theme={null}
           /bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-apiserver.yaml; then stat -c %U:%G /etc/kubernetes/manifests/kube-apiserver.yaml; fi'
           ```
           The output must be:
           ```text theme={null}
           root:root
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change file ownership on control plane nodes, so it cannot be used to remediate this finding on `/etc/kubernetes/manifests/kube-apiserver.yaml`. To fix this, you must adjust file ownership directly on every control plane node; see the Manual Steps section for the exact commands.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix ownership of kube-apiserver manifest to root:root on all control plane nodes.
        # Usage:
        #   1) Copy this script to each control plane node and run with sudo:
        #        sudo bash fix-kube-apiserver-ownership.sh
        #   2) Or run remotely via SSH from an admin host.

        set -euo pipefail

        MANIFEST_PATH="/etc/kubernetes/manifests/kube-apiserver.yaml"

        echo "=== [$(hostname)] Ensuring ownership of ${MANIFEST_PATH} is root:root ==="

        # Ensure script is run as root
        if [[ "$(id -u)" -ne 0 ]]; then
          echo "ERROR: This script must be run as root (use sudo)." >&2
          exit 1
        fi

        # Check if file exists
        if [[ ! -e "${MANIFEST_PATH}" ]]; then
          echo "NOTICE: ${MANIFEST_PATH} does not exist on this node. Nothing to do."
          exit 0
        fi

        # Show current ownership
        current_owner_group="$(stat -c '%U:%G' "${MANIFEST_PATH}")"
        echo "Current ownership: ${current_owner_group}"

        # Apply fix only if needed (idempotent)
        if [[ "${current_owner_group}" != "root:root" ]]; then
          echo "Changing ownership to root:root..."
          chown root:root "${MANIFEST_PATH}"
        else
          echo "Ownership already set to root:root. No change needed."
        fi

        # Verification
        echo "Verifying ownership..."
        verified_owner_group="$(stat -c '%U:%G' "${MANIFEST_PATH}")"
        echo "Verified ownership: ${verified_owner_group}"

        if [[ "${verified_owner_group}" != "root:root" ]]; then
          echo "ERROR: Failed to set ownership to root:root on ${MANIFEST_PATH}" >&2
          exit 2
        fi

        echo "SUCCESS: ${MANIFEST_PATH} is owned by root:root on node $(hostname)."
        ```

        **Operational notes:**

        * Run on: every control plane node.
        * Changing ownership of this manifest does not restart the kube-apiserver by itself; only content changes to files under `/etc/kubernetes/manifests` trigger static pod restarts.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>