Skip to main content

Ensure Kubernetes PKI Key File Permissions Are 600

More Info:​

Ensure that Kubernetes PKI key files have permissions of 600.

Risk Level​

High

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, list current key files and permissions to understand scope:

    sudo find /etc/kubernetes/pki/ -name '*.key' -printf '%p permissions=%m\n'

  2. On every control plane node, restrict permissions on all Kubernetes PKI key files:

    sudo chmod -R 600 /etc/kubernetes/pki/*.key

  3. On every control plane node, ensure ownership of the key files is root (adjust if needed):

    sudo chown root:root /etc/kubernetes/pki/*.key

  4. On every control plane node, re-verify that the permissions are correctly set to 600:

    sudo find /etc/kubernetes/pki/ -name '*.key' | xargs stat -c permissions=%a' %n'
Using kubectl

kubectl cannot modify file permissions on control plane nodes, so it cannot be used to fix /etc/kubernetes/pki/*.key permissions. This issue must be remediated directly on every control plane node’s filesystem; follow the guidance in the Manual Steps section to apply the required chmod 600 changes and verify them.

Automation
#!/usr/bin/env bash
#
# Remediation: Ensure Kubernetes PKI key files have permissions of 600
# Scope: Run on every control plane node
# Safe to re-run (idempotent)

set -euo pipefail

PKI_DIR="/etc/kubernetes/pki"

echo "==> Ensuring PKI directory exists: ${PKI_DIR}"
if [[ ! -d "${PKI_DIR}" ]]; then
  echo "PKI directory ${PKI_DIR} does not exist on this node. Nothing to do."
  exit 0
fi

echo "==> Finding Kubernetes PKI key files under ${PKI_DIR}"
mapfile -t KEY_FILES < <(find "${PKI_DIR}" -type f -name '*.key' 2>/dev/null || true)

if [[ ${#KEY_FILES[@]} -eq 0 ]]; then
  echo "No .key files found under ${PKI_DIR}. Nothing to do."
  exit 0
fi

echo "==> Adjusting permissions to 600 on all Kubernetes PKI key files"
for key_file in "${KEY_FILES[@]}"; do
  # Only change if not already 600
  current_perm=$(stat -c "%a" "${key_file}")
  if [[ "${current_perm}" != "600" ]]; then
    echo "  - Setting ${key_file} from ${current_perm} to 600"
    chmod 600 "${key_file}"
  else
    echo "  - ${key_file} already has permission 600"
  fi
done

echo "==> Verification: checking resulting permissions"
find "${PKI_DIR}" -name '*.key' | xargs stat -c 'permissions=%a %n'

echo "==> Completed. All Kubernetes PKI key files under ${PKI_DIR} should now be 600."

Usage:

  • Run this script on every control plane node (as root), e.g.:
    • scp fix_pki_permissions.sh root@CONTROL_PLANE_NODE:/root/
    • ssh root@CONTROL_PLANE_NODE "bash /root/fix_pki_permissions.sh"

Additional Reading:​