> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet config.yaml File Ownership Set To root:root

### More Info:

When a kubelet config.yaml file is in use it should be owned by root:root so only privileged users can alter the kubelet configuration. Incorrect ownership risks unauthorized changes to node security.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, confirm whether the kubelet config file exists and view its current ownership:
           ```bash theme={null}
           sudo ls -l /var/lib/kubelet/config.yaml
           ```

        2. On every worker node, set the ownership of the kubelet config file to root:root as required:
           ```bash theme={null}
           sudo chown root:root /var/lib/kubelet/config.yaml
           ```

        3. On every worker node, verify that the ownership is now correctly set:
           ```bash theme={null}
           sudo stat -c %U:%G /var/lib/kubelet/config.yaml
           ```
           The output must be:
           ```text theme={null}
           root:root
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change file ownership on nodes, including `/var/lib/kubelet/config.yaml`; this must be fixed directly on every worker node’s host filesystem. See the Manual Steps section for the exact `chown` command and how to verify the fix.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediate CIS Kubernetes 4.1.10:
        # Ensure /var/lib/kubelet/config.yaml (if present) is owned by root:root
        #
        # Run this script on every worker node with root privileges.
        # It is safe to re-run.

        set -euo pipefail

        CONFIG_PATH="/var/lib/kubelet/config.yaml"

        echo "=== CIS 4.1.10 remediation: kubelet config.yaml ownership ==="

        if [ ! -e "$CONFIG_PATH" ]; then
          echo "INFO: $CONFIG_PATH does not exist on this node. Nothing to do."
          exit 0
        fi

        current_owner="$(stat -c '%U:%G' "$CONFIG_PATH")"
        echo "Current ownership of $CONFIG_PATH: $current_owner"

        if [ "$current_owner" != "root:root" ]; then
          echo "Changing ownership of $CONFIG_PATH to root:root ..."
          chown root:root "$CONFIG_PATH"
        else
          echo "Ownership already set to root:root, no change needed."
        fi

        # Verification (from benchmark audit command)
        echo "Verifying ownership..."
        verified_owner="$(stat -c '%U:%G' "$CONFIG_PATH")"
        echo "Verified ownership of $CONFIG_PATH: $verified_owner"

        if [ "$verified_owner" != "root:root" ]; then
          echo "ERROR: Failed to set ownership of $CONFIG_PATH to root:root" >&2
          exit 1
        fi

        echo "SUCCESS: $CONFIG_PATH ownership is correctly set to root:root."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>