> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Etcd Pod Specification File Ownership Should Be root:root

### More Info:

Verifies that the etcd pod manifest file is owned by root:root so only privileged users can modify the datastore configuration.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, confirm the etcd manifest file exists and see its current ownership:
           ```sh theme={null}
           ls -l /etc/kubernetes/manifests/etcd.yaml
           ```

        2. On every control plane node, set the file owner and group to root:root:
           ```sh theme={null}
           sudo chown root:root /etc/kubernetes/manifests/etcd.yaml
           ```

        3. (Optional) Re-list the file to visually confirm ownership:
           ```sh theme={null}
           ls -l /etc/kubernetes/manifests/etcd.yaml
           ```

        4. On every control plane node, verify the fix using the audit-style command:
           ```sh theme={null}
           /bin/sh -c 'if test -e /etc/kubernetes/manifests/etcd.yaml; then find /etc/kubernetes/manifests/etcd.yaml -name "*etcd*" | xargs stat -c %U:%G; fi'
           ```
           The output must be:
           ```text theme={null}
           root:root
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file ownership on the host filesystem where the etcd static pod manifest (`/etc/kubernetes/manifests/etcd.yaml`) resides. This finding must be remediated directly on every control plane node’s OS; see the Manual Steps section for the required commands and procedure.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix ownership of the etcd static pod manifest so it is root:root
        # Scope: run on every control plane node (as root)
        set -euo pipefail

        ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"

        echo "==> Checking for etcd manifest at ${ETCD_MANIFEST}"

        if [[ ! -e "${ETCD_MANIFEST}" ]]; then
          echo "Etcd manifest not found at ${ETCD_MANIFEST}; nothing to do on this node."
          exit 0
        fi

        current_owner="$(stat -c '%U:%G' "${ETCD_MANIFEST}")"

        echo "Current ownership: ${current_owner}"

        if [[ "${current_owner}" != "root:root" ]]; then
          echo "Fixing ownership to root:root"
          chown root:root "${ETCD_MANIFEST}"
        else
          echo "Ownership already set to root:root; no change needed."
        fi

        echo "==> Verifying fix"
        stat -c '%U:%G %n' "${ETCD_MANIFEST}"

        echo
        echo "==> CIS 1.1.8 verification (should output 'root:root'):"
        /bin/sh -c 'if test -e /etc/kubernetes/manifests/etcd.yaml; then find /etc/kubernetes/manifests/etcd.yaml -name "*etcd*" | xargs stat -c %U:%G; fi'
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>