> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Proxy Kubeconfig File Ownership Set To root:root

### More Info:

If the kube-proxy kubeconfig file exists it should be owned by root:root so only privileged users can read or modify it. Incorrect ownership risks exposure of connection settings.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check if the proxy kubeconfig file exists and view its current ownership:
           ```sh theme={null}
           ls -l /etc/kubernetes/proxy.conf
           ```

        2. If the file exists and is not owned by root:root, change its ownership on that worker node:
           ```sh theme={null}
           sudo chown root:root /etc/kubernetes/proxy.conf
           ```

        3. Confirm the permissions are appropriate (readable only by root or as per your policy) and adjust if needed, for example:
           ```sh theme={null}
           sudo chmod 600 /etc/kubernetes/proxy.conf
           ```

        4. Repeat steps 1–3 on every worker node in the cluster where `/etc/kubernetes/proxy.conf` is present.

        5. Verify on each worker node that the ownership is now correctly set to root:root:
           ```sh theme={null}
           /bin/sh -c 'if test -e /etc/kubernetes/proxy.conf; then stat -c %U:%G /etc/kubernetes/proxy.conf; fi'
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        This setting is controlled by file ownership on each worker node’s filesystem and cannot be changed through the Kubernetes API, so kubectl cannot remediate it. To fix the issue, adjust the ownership of `/etc/kubernetes/proxy.conf` directly on every worker node as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Purpose: Ensure kube-proxy kubeconfig (/etc/kubernetes/proxy.conf) is owned by root:root
        # Scope:   Run on every worker node
        # Usage:   sudo /usr/local/sbin/fix-kube-proxy-kubeconfig-ownership.sh

        set -euo pipefail

        TARGET_FILE="/etc/kubernetes/proxy.conf"

        echo "==> Checking for ${TARGET_FILE}"

        if [ ! -e "${TARGET_FILE}" ]; then
          echo "    File not found; nothing to do on this node."
          exit 0
        fi

        CURRENT_OWNER_GROUP="$(stat -c '%U:%G' "${TARGET_FILE}")"

        if [ "${CURRENT_OWNER_GROUP}" = "root:root" ]; then
          echo "    Ownership already correct (root:root); no change needed."
        else
          echo "    Current ownership is ${CURRENT_OWNER_GROUP}; updating to root:root"
          chown root:root "${TARGET_FILE}"
        fi

        echo "==> Verifying ownership"
        VERIFY_OWNER_GROUP="$(stat -c '%U:%G' "${TARGET_FILE}")"

        if [ "${VERIFY_OWNER_GROUP}" != "root:root" ]; then
          echo "ERROR: Failed to set ownership to root:root (current: ${VERIFY_OWNER_GROUP})" >&2
          exit 1
        fi

        echo "    Verified: ${TARGET_FILE} is owned by root:root"
        exit 0
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>