> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet Kubeconfig File Permissions Set To 600 Or More Restrictive

### More Info:

The kubelet.conf kubeconfig file holds credentials the kubelet uses to authenticate to the API server. Permissions of 600 or more restrictive prevent non-privileged users from reading those credentials.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check the current permissions of the kubelet kubeconfig file:
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/kubelet.conf
           ```

        2. On every worker node, set the kubelet kubeconfig file permissions to 600:
           ```bash theme={null}
           chmod 600 /etc/kubernetes/kubelet.conf
           ```

        3. (Optional, recommended) On every worker node, ensure the file is owned by root:
           ```bash theme={null}
           chown root:root /etc/kubernetes/kubelet.conf
           ```

        4. On every worker node, verify the new permissions match the benchmark requirement:
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/kubelet.conf
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on node-local paths like `/etc/kubernetes/kubelet.conf`; this must be fixed directly on every worker node’s host filesystem. Use the guidance in the Manual Steps section to adjust the permissions and verify the change.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Harden kubelet.conf permissions on all worker nodes.
        # Usage:
        #   1) Create an inventory file with one worker node (IP or hostname) per line, e.g.:
        #        /etc/kubernetes/worker-nodes.txt
        #   2) Run:
        #        bash secure-kubelet-kubeconfig.sh /etc/kubernetes/worker-nodes.txt
        #
        # Requirements:
        #   - Run from any machine with SSH access to every worker node.
        #   - SSH key-based auth to each node as a user with sudo privileges.
        #   - 'stat', 'chmod', and 'sudo' available on the worker nodes.

        set -euo pipefail

        INVENTORY_FILE="${1:-}"

        if [[ -z "${INVENTORY_FILE}" || ! -f "${INVENTORY_FILE}" ]]; then
          echo "Usage: $0 /path/to/worker-nodes.txt" >&2
          exit 1
        fi

        SSH_USER="${SSH_USER:-$(whoami)}"
        SSH_OPTS="${SSH_OPTS:--o BatchMode=yes -o StrictHostKeyChecking=accept-new}"

        REMOTE_FILE="/etc/kubernetes/kubelet.conf"
        TARGET_PERMS="600"

        echo "Using SSH user: ${SSH_USER}"
        echo "Worker node inventory: ${INVENTORY_FILE}"
        echo "Target permissions for ${REMOTE_FILE}: ${TARGET_PERMS}"
        echo

        while IFS= read -r NODE || [[ -n "$NODE" ]]; do
          # Skip empty lines and comments
          [[ -z "$NODE" || "$NODE" =~ ^# ]] && continue

          echo "==== Processing worker node: ${NODE} ===="

          # Check if file exists
          if ! ssh ${SSH_OPTS} "${SSH_USER}@${NODE}" "test -e '${REMOTE_FILE}'"; then
            echo "  [SKIP] ${REMOTE_FILE} not found on ${NODE}"
            continue
          fi

          # Ensure permissions are 600 (idempotent: running chmod 600 repeatedly is safe)
          ssh ${SSH_OPTS} "${SSH_USER}@${NODE}" "sudo chmod ${TARGET_PERMS} '${REMOTE_FILE}'"

          # Verification (adapted from audit command)
          PERMS=$(ssh ${SSH_OPTS} "${SSH_USER}@${NODE}" "/bin/sh -c 'if test -e \"${REMOTE_FILE}\"; then stat -c permissions=%a \"${REMOTE_FILE}\"; fi'")

          if [[ "${PERMS}" == "permissions=${TARGET_PERMS}" ]]; then
            echo "  [OK] ${REMOTE_FILE} permissions on ${NODE} are ${PERMS}"
          else
            echo "  [WARN] ${REMOTE_FILE} permissions on ${NODE} are ${PERMS}, expected permissions=${TARGET_PERMS}" >&2
          fi

          echo
        done < "${INVENTORY_FILE}"

        echo "Completed kubelet.conf permission hardening on all listed worker nodes."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>