> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Scheduler Kubeconfig File Permissions Should Be 600 Or More Restrictive

### More Info:

Verifies that the scheduler.conf kubeconfig file has permissions of 600 or more restrictive to protect the schedulers client credentials.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, check the current permissions of the scheduler kubeconfig file:
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/scheduler.conf
           ```

        2. On every control plane node, set the permissions of the scheduler kubeconfig file to 600:
           ```bash theme={null}
           sudo chmod 600 /etc/kubernetes/scheduler.conf
           ```

        3. On every control plane node, verify that the permissions are now 600:
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/scheduler.conf
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on control plane nodes, including `/etc/kubernetes/scheduler.conf`. This fix must be applied directly on every control plane node at the host OS level; see the Manual Steps section for the exact commands to run there.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Automation: Fix scheduler.conf file permissions (CIS Kubernetes 1.1.15)
        # Target: every control plane node
        #
        # Usage:
        #   1) Copy this script to each control plane node.
        #   2) Run as root:  bash fix_scheduler_kubeconfig_perms.sh
        #

        set -euo pipefail

        SCHEDULER_CONF="/etc/kubernetes/scheduler.conf"
        DESIRED_PERMS="600"

        echo "=== Checking for ${SCHEDULER_CONF} ==="

        if [ ! -e "${SCHEDULER_CONF}" ]; then
          echo "File not found: ${SCHEDULER_CONF}"
          echo "Nothing to change on this node."
        else
          # Show current permissions
          CURRENT_PERMS="$(stat -c '%a' "${SCHEDULER_CONF}")"
          echo "Current permissions: ${CURRENT_PERMS}"

          # Apply fix only if needed
          if [ "${CURRENT_PERMS}" != "${DESIRED_PERMS}" ]; then
            echo "Setting permissions to ${DESIRED_PERMS} on ${SCHEDULER_CONF}"
            chmod "${DESIRED_PERMS}" "${SCHEDULER_CONF}"
          else
            echo "Permissions already set to ${DESIRED_PERMS}; no change needed."
          fi

          # Verification (same logic as audit command)
          echo "=== Verifying permissions ==="
          stat -c 'permissions=%a  file=%n' "${SCHEDULER_CONF}"
        fi

        echo "=== Completed scheduler.conf permissions check ==="
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>