> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubernetes PKI Directory And File Ownership Is Root

### More Info:

Ensure that the Kubernetes PKI directory and file ownership is set to root:root.

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, review current ownership of the PKI directory and files:
           ```bash theme={null}
           sudo find /etc/kubernetes/pki/ | xargs stat -c '%n %U:%G'
           ```

        2. On every control plane node, change ownership of the PKI directory and all contents to root:root:
           ```bash theme={null}
           sudo chown -R root:root /etc/kubernetes/pki/
           ```

        3. On every control plane node, re-check ownership to ensure all entries are now root:root:
           ```bash theme={null}
           sudo find /etc/kubernetes/pki/ | xargs stat -c '%n %U:%G' | grep -v ' root:root' || echo "All PKI files owned by root:root"
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change file and directory ownership on control plane nodes, including `/etc/kubernetes/pki/`. This finding must be remediated directly on each control plane node’s host filesystem (see the Manual Steps section for the required `chown` command and verification).
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediation: Ensure Kubernetes PKI directory and file ownership is root:root
        # Scope: Run on every control plane node
        # Idempotent: Safe to re-run; only fixes incorrect ownerships.
        #

        set -euo pipefail

        PKI_DIR="/etc/kubernetes/pki"

        echo "=== [1/3] Validating PKI directory exists: ${PKI_DIR} ==="
        if [[ ! -d "${PKI_DIR}" ]]; then
          echo "ERROR: ${PKI_DIR} does not exist on this node. Are you on a control plane node?"
          exit 1
        fi

        echo "=== [2/3] Updating ownership to root:root (idempotent) ==="
        # This will only change entries that are not already root:root.
        sudo chown -R root:root "${PKI_DIR}"

        echo "=== [3/3] Verifying ownership is now root:root ==="
        # Show any entries that are NOT root:root; expect no output.
        NON_ROOT_OWNERS=$(
          sudo find "${PKI_DIR}" -mindepth 1 -print0 \
          | xargs -0 -n1 stat -c '%n %U:%G' \
          | awk '$2 != "root" || $3 != "root"'
        )

        if [[ -n "${NON_ROOT_OWNERS}" ]]; then
          echo "FAIL: The following PKI files/directories are not owned by root:root:"
          echo "${NON_ROOT_OWNERS}"
          echo
          echo "Full ownership listing for troubleshooting:"
          sudo find "${PKI_DIR}" | xargs stat -c '%n %U:%G'
          exit 2
        fi

        echo "SUCCESS: All entries under ${PKI_DIR} are owned by root:root."
        echo
        echo "Audit output (for record):"
        sudo find "${PKI_DIR}" | xargs stat -c '%U:%G'
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)