> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes PKI Key File Permissions Should Be 600

### More Info:

Verifies that Kubernetes PKI private key files have permissions of 600. Exposure of these keys would let an attacker impersonate cluster components.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Log in to each control plane node**\
           Use SSH or your usual access method to connect to every control plane node where `/etc/kubernetes/pki` exists.

        2. **Review current key file permissions**\
           On each control plane node, list all private key files and their permissions:
           ```bash theme={null}
           sudo find /etc/kubernetes/pki/ -name '*.key' -exec stat -c '%n permissions=%a owner=%U group=%G' {} \;
           ```

        3. **Set private key permissions to 600**\
           On each control plane node, restrict permissions on all Kubernetes PKI private keys:
           ```bash theme={null}
           sudo chmod -R 600 /etc/kubernetes/pki/*.key
           ```

        4. **Confirm ownership is root:root (review and adjust if needed)**\
           Still on each control plane node, check ownership:
           ```bash theme={null}
           sudo find /etc/kubernetes/pki/ -name '*.key' -exec stat -c '%n owner=%U group=%G' {} \;
           ```
           If any key is not owned by root:root, adjust as appropriate for your environment, for example:
           ```bash theme={null}
           sudo chown root:root /etc/kubernetes/pki/<specific-key-file>.key
           ```

        5. **Verify final permissions match the benchmark**\
           On each control plane node, re-run the audit to confirm all keys are now 600:
           ```bash theme={null}
           sudo find /etc/kubernetes/pki/ -name '*.key' | xargs stat -c permissions=%a
           ```
           Ensure every reported `permissions=` value is `600`.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on control plane node files such as `/etc/kubernetes/pki/*.key`; this must be fixed directly on every control plane node’s filesystem. Refer to the Manual Steps section for the exact commands to run over SSH on those nodes.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Harden Kubernetes PKI private key permissions on all control plane nodes.
        # Target: run on every control plane node (as root or with sudo).
        # Idempotent: safe to run multiple times.

        set -euo pipefail

        PKI_DIR="/etc/kubernetes/pki"
        KEY_GLOB="${PKI_DIR}/*.key"

        echo "==> Ensuring Kubernetes PKI key file permissions are 600 under ${PKI_DIR}"

        if [ ! -d "${PKI_DIR}" ]; then
          echo "PKI directory ${PKI_DIR} does not exist on this node; nothing to do."
          exit 0
        fi

        # Find all .key files (if none, exit cleanly)
        mapfile -t KEY_FILES < <(find "${PKI_DIR}" -maxdepth 1 -type f -name '*.key' 2>/dev/null || true)

        if [ "${#KEY_FILES[@]}" -eq 0 ]; then
          echo "No *.key files found in ${PKI_DIR}; nothing to do."
          exit 0
        fi

        echo "Found ${#KEY_FILES[@]} key file(s):"
        printf '  %s\n' "${KEY_FILES[@]}"

        # Apply permissions 600 to each key file (idempotent)
        for key_file in "${KEY_FILES[@]}"; do
          if [ ! -f "${key_file}" ]; then
            continue
          fi
          current_perm=$(stat -c '%a' "${key_file}")
          if [ "${current_perm}" != "600" ]; then
            echo "  Setting permissions 600 on ${key_file} (was ${current_perm})"
            chmod 600 "${key_file}"
          else
            echo "  Permissions already 600 on ${key_file}; skipping"
          fi
        done

        echo
        echo "==> Verification (should show permissions=600 for each .key file)"
        find "${PKI_DIR}/" -name '*.key' | xargs stat -c 'permissions=%a %n' || true
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>