> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Controller Manager Pod Specification File Permissions Should Be 600 Or More Restrictive

### More Info:

Verifies that the kube-controller-manager pod manifest file has permissions of 600 or more restrictive. This prevents unauthorized modification of the controller manager configuration.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, confirm the controller manager manifest file exists and note its current permissions:
           ```sh theme={null}
           sudo ls -l /etc/kubernetes/manifests/kube-controller-manager.yaml
           ```

        2. On every control plane node, set the file permissions to 600:
           ```sh theme={null}
           sudo chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml
           ```

        3. (Optional) On every control plane node, set the file owner and group to root (if not already) to further restrict access:
           ```sh theme={null}
           sudo chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml
           ```

        4. Be aware: modifying a static pod manifest under `/etc/kubernetes/manifests` may cause the kubelet to detect and restart the `kube-controller-manager` pod if it sees the file as changed. Perform this during a maintenance window if your environment is sensitive to control plane component restarts.

        5. On every control plane node, verify the permissions are now 600 or more restrictive:
           ```sh theme={null}
           stat -c permissions=%a /etc/kubernetes/manifests/kube-controller-manager.yaml
           ```
           Confirm the output shows `permissions=600` (or a more restrictive value such as `permissions=400`).
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on control plane hosts, including `/etc/kubernetes/manifests/kube-controller-manager.yaml`. This must be fixed directly on every control plane node at the host level; follow the guidance in the Manual Steps section to update the file mode and verify it.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fixes CIS Kubernetes 1.1.3:
        # Ensures /etc/kubernetes/manifests/kube-controller-manager.yaml has permissions 600
        # Run this on every control plane node.
        # Safe to re-run (idempotent).

        set -euo pipefail

        TARGET_FILE="/etc/kubernetes/manifests/kube-controller-manager.yaml"
        REQUIRED_MODE="600"
        EXIT_CODE=0

        echo "=== CIS 1.1.3: kube-controller-manager manifest permissions ==="

        if [ ! -e "$TARGET_FILE" ]; then
          echo "SKIP: $TARGET_FILE does not exist on this node."
          exit 0
        fi

        # Show current permissions
        CURRENT_MODE=$(stat -c '%a' "$TARGET_FILE")
        echo "Current permissions for $TARGET_FILE: $CURRENT_MODE"

        # Apply fix only if needed
        if [ "$CURRENT_MODE" != "$REQUIRED_MODE" ]; then
          echo "Updating permissions to $REQUIRED_MODE ..."
          chmod "$REQUIRED_MODE" "$TARGET_FILE"
        fi

        # Verification (from benchmark audit logic)
        VERIFY_OUTPUT=$(stat -c 'permissions=%a' "$TARGET_FILE")
        echo "Verification: $VERIFY_OUTPUT"

        if [ "$VERIFY_OUTPUT" != "permissions=$REQUIRED_MODE" ]; then
          echo "ERROR: Failed to set required permissions ($REQUIRED_MODE) on $TARGET_FILE" >&2
          EXIT_CODE=1
        else
          echo "SUCCESS: $TARGET_FILE permissions are set to $REQUIRED_MODE"
        fi

        exit $EXIT_CODE
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>