> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet config.yaml File Permissions Set To 600 Or More Restrictive

### More Info:

When a kubelet config.yaml file is in use it defines the kubelets security settings and should be protected from modification. Permissions of 600 or more restrictive keep it readable only by root.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, verify that the kubelet config file exists and note its current permissions:
           ```sh theme={null}
           ls -l /var/lib/kubelet/config.yaml
           ```

        2. On every worker node, set the file permissions to 600 as required:
           ```sh theme={null}
           chmod 600 /var/lib/kubelet/config.yaml
           ```

        3. On every worker node, ensure the file is owned by root (optional hardening but commonly expected):
           ```sh theme={null}
           chown root:root /var/lib/kubelet/config.yaml
           ```

        4. On every worker node, verify the permissions are now 600 or more restrictive:
           ```sh theme={null}
           stat -c permissions=%a /var/lib/kubelet/config.yaml
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify host-level file permissions such as `/var/lib/kubelet/config.yaml` on worker nodes. This fix must be performed directly on every worker node (for example over SSH); see the Manual Steps section for the exact commands to run.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediate CIS Kubernetes 4.1.9:
        # Ensure /var/lib/kubelet/config.yaml permissions are 600 or more restrictive
        # Scope: run on every worker node (can also be run on control plane nodes; it
        #        will only act if the file exists).
        set -euo pipefail

        CONFIG_PATH="/var/lib/kubelet/config.yaml"
        DESIRED_MODE="600"

        echo "==> CIS 4.1.9: Ensuring ${CONFIG_PATH} permissions are ${DESIRED_MODE} on this node"

        if [ ! -e "${CONFIG_PATH}" ]; then
          echo "    File not found: ${CONFIG_PATH} (nothing to do on this node)"
        else
          # Get current mode without leading zeros (e.g. 600, 640, 644)
          CURRENT_MODE="$(stat -c '%a' "${CONFIG_PATH}")"

          if [ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]; then
            echo "    Current mode is ${CURRENT_MODE}, setting to ${DESIRED_MODE}"
            chmod "${DESIRED_MODE}" "${CONFIG_PATH}"
          else
            echo "    Mode already ${DESIRED_MODE}, no change needed"
          fi

          # Verification step (from the audit command)
          echo "==> Verifying permissions"
          /bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c permissions=%a /var/lib/kubelet/config.yaml; fi'
        fi

        echo "==> Completed CIS 4.1.9 remediation on this node"
        ```

        Usage:

        * Copy this script to a file, for example on any machine with SSH access to the nodes:
          * `/tmp/fix-kubelet-config-perms.sh`
        * Distribute and run it on every worker node (and any other node that may run a kubelet):

        ```bash theme={null}
        # From your admin machine, example with SSH (adjust hostnames/IPs and user)
        for NODE in worker1 worker2 worker3; do
          echo "=== ${NODE} ==="
          scp /tmp/fix-kubelet-config-perms.sh "${NODE}:/tmp/fix-kubelet-config-perms.sh"
          ssh "${NODE}" "sudo bash /tmp/fix-kubelet-config-perms.sh"
        done
        ```

        The script is idempotent: re-running it will only change permissions if they are not already `600`, and it always prints the final `stat` output as verification.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>