> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes PKI Directory And File Ownership Should Be root:root

### More Info:

Verifies that the Kubernetes PKI directory and its files are owned by root:root so only privileged users can access the cluster certificates and keys.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, review current ownership of the PKI directory and its contents:
           ```bash theme={null}
           sudo find /etc/kubernetes/pki/ -xdev -exec stat -c '%n %U:%G' {} \;
           ```

        2. If any entry is not owned by root:root, correct the ownership of the entire PKI tree:
           ```bash theme={null}
           sudo chown -R root:root /etc/kubernetes/pki/
           ```

        3. Re-check for any remaining non-root:root ownership (should return no output):
           ```bash theme={null}
           sudo find /etc/kubernetes/pki/ -xdev ! -user root -o ! -group root
           ```

        4. Verify compliance using the audit-style command:
           ```bash theme={null}
           sudo find /etc/kubernetes/pki/ | xargs stat -c %U:%G | sort -u
           ```
           Ensure the output contains only:
           ```text theme={null}
           root:root
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change file ownership or permissions on the node filesystem, including `/etc/kubernetes/pki/`. This finding must be remediated directly on every control plane node via host-level commands; see the **Manual Steps** section for how to fix and verify the ownership.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Purpose: Ensure Kubernetes PKI directory and file ownership is root:root
        # Scope:   Run on every control plane node
        # Usage:   sudo bash fix-k8s-pki-ownership.sh

        set -euo pipefail

        PKI_DIR="/etc/kubernetes/pki"

        echo "=== Kubernetes PKI ownership remediation ==="
        echo "Target directory: ${PKI_DIR}"
        echo

        # 1) Pre-checks
        if [[ "$(id -u)" -ne 0 ]]; then
          echo "ERROR: This script must be run as root." >&2
          exit 1
        fi

        if [[ ! -d "${PKI_DIR}" ]]; then
          echo "No PKI directory found at ${PKI_DIR}. Nothing to do on this node."
          exit 0
        fi

        # 2) Show current ownership for visibility
        echo "Current ownership (before fix):"
        find "${PKI_DIR}/" -print0 | xargs -0 stat -c '%n %U:%G' | sort
        echo

        # 3) Apply remediation (idempotent)
        echo "Applying chown -R root:root ${PKI_DIR}/ ..."
        chown -R root:root "${PKI_DIR}/"
        echo "Ownership change complete."
        echo

        # 4) Verification (authoritative audit)
        echo "Verifying ownership (expected: root:root for all paths)..."
        VERIFY_OUTPUT="$(find "${PKI_DIR}/" -print0 | xargs -0 stat -c '%U:%G' | sort -u)"

        echo "${VERIFY_OUTPUT}"
        echo

        if [[ "${VERIFY_OUTPUT}" == "root:root" ]]; then
          echo "SUCCESS: All files and directories under ${PKI_DIR}/ are owned by root:root."
          exit 0
        else
          echo "WARNING: Some entries under ${PKI_DIR}/ are not owned by root:root." >&2
          echo "Please review the above lines and adjust manually if required."
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>