> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Controller Manager Kubeconfig File Permissions Should Be 600 Or More Restrictive

### More Info:

Verifies that the controller-manager.conf kubeconfig file has permissions of 600 or more restrictive to protect the controller managers client credentials.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Check current permissions** (run on every control plane node):
           ```bash theme={null}
           stat -c 'permissions=%a  file=%n' /etc/kubernetes/controller-manager.conf
           ```

        2. **Set restrictive permissions (600)** (run on every control plane node):
           ```bash theme={null}
           chmod 600 /etc/kubernetes/controller-manager.conf
           ```

        3. **Set secure ownership (root:root)** if needed (run on every control plane node):
           ```bash theme={null}
           chown root:root /etc/kubernetes/controller-manager.conf
           ```

        4. **Verify final permissions** (run on every control plane node):
           ```bash theme={null}
           stat -c 'permissions=%a  owner=%U  group=%G  file=%n' /etc/kubernetes/controller-manager.conf
           ```
           Confirm that `permissions=600` and `owner=root  group=root`.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on control plane nodes, so it cannot be used to fix `/etc/kubernetes/controller-manager.conf`. Apply the remediation directly on every control plane node’s host OS as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fixes CIS Kubernetes 1.1.17:
        # Ensures /etc/kubernetes/controller-manager.conf has file mode 600 (or more restrictive).
        #
        # Run on: every control plane node
        # Usage: sudo ./fix-controller-manager-kubeconfig-perms.sh

        set -euo pipefail

        TARGET_FILE="/etc/kubernetes/controller-manager.conf"
        DESIRED_MODE="600"

        echo "[INFO] Checking for ${TARGET_FILE}"

        if [ ! -e "${TARGET_FILE}" ]; then
          echo "[WARN] ${TARGET_FILE} does not exist on this node. Nothing to do."
        else
          # Get current permissions in octal (e.g. 640, 600, 444)
          CURRENT_MODE="$(stat -c '%a' "${TARGET_FILE}")"

          echo "[INFO] Current mode for ${TARGET_FILE}: ${CURRENT_MODE}"

          if [ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]; then
            echo "[INFO] Setting mode ${DESIRED_MODE} on ${TARGET_FILE}"
            chmod "${DESIRED_MODE}" "${TARGET_FILE}"
          else
            echo "[INFO] Mode already ${DESIRED_MODE}; no change needed."
          fi

          # Verification (adapted from the audit command)
          echo "[INFO] Verifying permissions:"
          stat -c 'permissions=%a path=%n' "${TARGET_FILE}"

          FINAL_MODE="$(stat -c '%a' "${TARGET_FILE}")"
          if [ "${FINAL_MODE}" != "${DESIRED_MODE}" ]; then
            echo "[ERROR] Failed to enforce mode ${DESIRED_MODE} on ${TARGET_FILE} (current: ${FINAL_MODE})" >&2
            exit 1
          fi

          echo "[INFO] Verification successful: ${TARGET_FILE} is set to ${DESIRED_MODE}"
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>