> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubernetes PKI Certificate File Permissions Are Restrictive

### More Info:

Ensure that Kubernetes PKI certificate files have permissions of 644 or more restrictive.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, list current certificate permissions for awareness:
           ```bash theme={null}
           find /etc/kubernetes/pki/ -name '*.crt' | xargs stat -c '%n permissions=%a owner=%U group=%G'
           ```

        2. Still on each control plane node, restrict permissions on all Kubernetes PKI certificate files:
           ```bash theme={null}
           chmod -R 644 /etc/kubernetes/pki/*.crt
           ```

        3. Ensure the certificate files are owned by root (adjust if needed):
           ```bash theme={null}
           chown root:root /etc/kubernetes/pki/*.crt
           ```

        4. Recheck permissions, ownership, and group to confirm they are at most 644 and root-owned:
           ```bash theme={null}
           find /etc/kubernetes/pki/ -name '*.crt' | xargs stat -c '%n permissions=%a owner=%U group=%G'
           ```

        5. On each control plane node, run the benchmark audit command to verify compliance:
           ```bash theme={null}
           find /etc/kubernetes/pki/ -name '*.crt' | xargs stat -c permissions=%a
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on control plane nodes, so this finding cannot be fixed through Kubernetes API objects. To remediate it, adjust the certificate file permissions directly on every control plane node’s filesystem (for example under `/etc/kubernetes/pki`) as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Harden Kubernetes PKI certificate file permissions on control plane nodes.
        # Target: every control plane node
        # Requirement: all /etc/kubernetes/pki/*.crt must be 644 or more restrictive.
        #
        # Usage:
        #   1) Copy this script to each control plane node, e.g. /root/fix-pki-crt-perms.sh
        #   2) Run as root:  bash /root/fix-pki-crt-perms.sh
        #   3) Safe to re-run; it is idempotent.

        set -euo pipefail

        PKI_DIR="/etc/kubernetes/pki"

        echo "=== Kubernetes PKI certificate permissions hardening ==="
        echo "Target directory: ${PKI_DIR}"
        echo

        # 1. Check directory exists
        if [ ! -d "${PKI_DIR}" ]; then
          echo "Directory ${PKI_DIR} does not exist on this node. Nothing to do."
          exit 0
        fi

        # 2. Show current permissions
        echo "Current permissions for *.crt under ${PKI_DIR}:"
        find "${PKI_DIR}" -type f -name '*.crt' -print0 2>/dev/null | \
          xargs -0 -I{} stat -c '%n permissions=%a' {} 2>/dev/null || \
          echo "No .crt files found under ${PKI_DIR}."
        echo

        # 3. Apply remediation: set mode 644 on all .crt files (idempotent)
        echo "Applying permissions: chmod 644 on all *.crt under ${PKI_DIR} ..."
        # Only act if there are any matching files
        if find "${PKI_DIR}" -type f -name '*.crt' -print -quit 2>/dev/null | grep -q .; then
          find "${PKI_DIR}" -type f -name '*.crt' -print0 2>/dev/null | \
            xargs -0 chmod 644
        else
          echo "No .crt files found; skipping chmod."
        fi
        echo "Permissions update complete."
        echo

        # 4. Verification (adapted from audit command)
        echo "Verification: resulting permissions for *.crt under ${PKI_DIR}:"
        if find "${PKI_DIR}" -type f -name '*.crt' -print -quit 2>/dev/null | grep -q .; then
          find "${PKI_DIR}" -type f -name '*.crt' | xargs stat -c 'permissions=%a %n'
        else
          echo "No .crt files found under ${PKI_DIR}."
        fi

        # 5. Check for non-compliant files (permissions > 644)
        echo
        echo "Checking for any certificate files still more permissive than 644..."
        NON_COMPLIANT=$(find "${PKI_DIR}" -type f -name '*.crt' -printf '%p %m\n' 2>/dev/null | awk '$2 > 644')

        if [ -n "${NON_COMPLIANT}" ]; then
          echo "WARNING: The following files remain more permissive than 644 and should be reviewed:"
          echo "${NON_COMPLIANT}"
          exit 1
        else
          echo "All Kubernetes PKI certificate files under ${PKI_DIR} are now 644 or more restrictive."
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)