Skip to main content

Ensure Kubernetes PKI Directory And File Ownership Is Root

More Info:​

Ensure that the Kubernetes PKI directory and file ownership is set to root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, review current ownership of the PKI directory and files:

    sudo find /etc/kubernetes/pki/ | xargs stat -c '%n %U:%G'

  2. On every control plane node, change ownership of the PKI directory and all contents to root:root:

    sudo chown -R root:root /etc/kubernetes/pki/

  3. On every control plane node, re-check ownership to ensure all entries are now root:root:

    sudo find /etc/kubernetes/pki/ | xargs stat -c '%n %U:%G' | grep -v ' root:root' || echo "All PKI files owned by root:root"
Using kubectl

kubectl cannot change file and directory ownership on control plane nodes, including /etc/kubernetes/pki/. This finding must be remediated directly on each control plane node’s host filesystem (see the Manual Steps section for the required chown command and verification).

Automation
#!/usr/bin/env bash
#
# Remediation: Ensure Kubernetes PKI directory and file ownership is root:root
# Scope: Run on every control plane node
# Idempotent: Safe to re-run; only fixes incorrect ownerships.
#

set -euo pipefail

PKI_DIR="/etc/kubernetes/pki"

echo "=== [1/3] Validating PKI directory exists: ${PKI_DIR} ==="
if [[ ! -d "${PKI_DIR}" ]]; then
  echo "ERROR: ${PKI_DIR} does not exist on this node. Are you on a control plane node?"
  exit 1
fi

echo "=== [2/3] Updating ownership to root:root (idempotent) ==="
# This will only change entries that are not already root:root.
sudo chown -R root:root "${PKI_DIR}"

echo "=== [3/3] Verifying ownership is now root:root ==="
# Show any entries that are NOT root:root; expect no output.
NON_ROOT_OWNERS=$(
  sudo find "${PKI_DIR}" -mindepth 1 -print0 \
  | xargs -0 -n1 stat -c '%n %U:%G' \
  | awk '$2 != "root" || $3 != "root"'
)

if [[ -n "${NON_ROOT_OWNERS}" ]]; then
  echo "FAIL: The following PKI files/directories are not owned by root:root:"
  echo "${NON_ROOT_OWNERS}"
  echo
  echo "Full ownership listing for troubleshooting:"
  sudo find "${PKI_DIR}" | xargs stat -c '%n %U:%G'
  exit 2
fi

echo "SUCCESS: All entries under ${PKI_DIR} are owned by root:root."
echo
echo "Audit output (for record):"
sudo find "${PKI_DIR}" | xargs stat -c '%U:%G'

Additional Reading:​