> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet Service File Ownership Set To root:root

### More Info:

The kubelet service file should be owned by root:root so that only privileged users can alter it. Incorrect ownership could allow unauthorized modification of the kubelet startup.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, verify the current ownership of the kubelet service file:
           ```bash theme={null}
           stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```

        2. On every worker node, set the ownership of the kubelet service file to root:root:
           ```bash theme={null}
           sudo chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           ```

        3. On every worker node, confirm the change took effect (verification):
           ```bash theme={null}
           /bin/sh -c "if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; else echo \"File not found\"; fi"
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify host-level systemd unit files such as `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on worker nodes; the ownership must be corrected directly on each node’s OS. Please follow the guidance in the Manual Steps section on every worker node to fix the file ownership and then re-run the audit command to verify.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix CISKubernetes 4.1.2:
        # Ensure kubelet service file ownership is set to root:root
        #
        # Usage:
        #   1) Copy this script to every worker node (or run via SSH/Ansible).
        #   2) Run as root:  sudo bash ./fix-kubelet-service-ownership.sh

        set -euo pipefail

        KUBELET_UNIT_OVERRIDE="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"

        echo "[INFO] Checking kubelet service file on this node: ${KUBELET_UNIT_OVERRIDE}"

        if [ ! -e "${KUBELET_UNIT_OVERRIDE}" ]; then
          echo "[WARN] File not found: ${KUBELET_UNIT_OVERRIDE}"
          echo "[WARN] Nothing to change on this node."
          exit 0
        fi

        # Current ownership
        current_owner_group="$(stat -c '%U:%G' "${KUBELET_UNIT_OVERRIDE}")" || {
          echo "[ERROR] Failed to stat ${KUBELET_UNIT_OVERRIDE}"
          exit 1
        }

        echo "[INFO] Current ownership: ${current_owner_group}"

        # Only change if needed (idempotent)
        if [ "${current_owner_group}" != "root:root" ]; then
          echo "[INFO] Updating ownership to root:root"
          chown root:root "${KUBELET_UNIT_OVERRIDE}"
        else
          echo "[INFO] Ownership already root:root; no change needed."
        fi

        # Verification (as per audit command)
        echo "[INFO] Verifying ownership after change:"
        audit_result="$(
          /bin/sh -c "if test -e ${KUBELET_UNIT_OVERRIDE}; then stat -c %U:%G ${KUBELET_UNIT_OVERRIDE}; else echo 'File not found'; fi"
        )"

        echo "[INFO] Audit output: ${audit_result}"

        if [ "${audit_result}" != "root:root" ]; then
          echo "[ERROR] Verification failed: expected root:root, got ${audit_result}"
          exit 1
        fi

        echo "[INFO] Verification successful: kubelet service file is owned by root:root"
        exit 0
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>