> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Kubernetes PKI Key File Permissions Are 600

### More Info:

Ensure that Kubernetes PKI key files have permissions of 600.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, list current key files and permissions to understand scope:
           ```bash theme={null}
           sudo find /etc/kubernetes/pki/ -name '*.key' -printf '%p permissions=%m\n'
           ```

        2. On every control plane node, restrict permissions on all Kubernetes PKI key files:
           ```bash theme={null}
           sudo chmod -R 600 /etc/kubernetes/pki/*.key
           ```

        3. On every control plane node, ensure ownership of the key files is root (adjust if needed):
           ```bash theme={null}
           sudo chown root:root /etc/kubernetes/pki/*.key
           ```

        4. On every control plane node, re-verify that the permissions are correctly set to 600:
           ```bash theme={null}
           sudo find /etc/kubernetes/pki/ -name '*.key' | xargs stat -c permissions=%a' %n'
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on control plane nodes, so it cannot be used to fix `/etc/kubernetes/pki/*.key` permissions. This issue must be remediated directly on every control plane node’s filesystem; follow the guidance in the **Manual Steps** section to apply the required `chmod 600` changes and verify them.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediation: Ensure Kubernetes PKI key files have permissions of 600
        # Scope: Run on every control plane node
        # Safe to re-run (idempotent)

        set -euo pipefail

        PKI_DIR="/etc/kubernetes/pki"

        echo "==> Ensuring PKI directory exists: ${PKI_DIR}"
        if [[ ! -d "${PKI_DIR}" ]]; then
          echo "PKI directory ${PKI_DIR} does not exist on this node. Nothing to do."
          exit 0
        fi

        echo "==> Finding Kubernetes PKI key files under ${PKI_DIR}"
        mapfile -t KEY_FILES < <(find "${PKI_DIR}" -type f -name '*.key' 2>/dev/null || true)

        if [[ ${#KEY_FILES[@]} -eq 0 ]]; then
          echo "No .key files found under ${PKI_DIR}. Nothing to do."
          exit 0
        fi

        echo "==> Adjusting permissions to 600 on all Kubernetes PKI key files"
        for key_file in "${KEY_FILES[@]}"; do
          # Only change if not already 600
          current_perm=$(stat -c "%a" "${key_file}")
          if [[ "${current_perm}" != "600" ]]; then
            echo "  - Setting ${key_file} from ${current_perm} to 600"
            chmod 600 "${key_file}"
          else
            echo "  - ${key_file} already has permission 600"
          fi
        done

        echo "==> Verification: checking resulting permissions"
        find "${PKI_DIR}" -name '*.key' | xargs stat -c 'permissions=%a %n'

        echo "==> Completed. All Kubernetes PKI key files under ${PKI_DIR} should now be 600."
        ```

        Usage:

        * Run this script on every control plane node (as root), e.g.:
          * `scp fix_pki_permissions.sh root@CONTROL_PLANE_NODE:/root/`
          * `ssh root@CONTROL_PLANE_NODE "bash /root/fix_pki_permissions.sh"`
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)