> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Scheduler Pod Specification File Permissions Should Be 600 Or More Restrictive

### More Info:

Verifies that the kube-scheduler pod manifest file has permissions of 600 or more restrictive to prevent unauthorized tampering.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, check the current permissions of the scheduler manifest file:
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/manifests/kube-scheduler.yaml
           ```

        2. On every control plane node, set the permissions to 600 as required:
           ```bash theme={null}
           chmod 600 /etc/kubernetes/manifests/kube-scheduler.yaml
           ```

        3. (Optional, on every control plane node) Confirm file ownership is appropriate (typically root:root):
           ```bash theme={null}
           stat -c 'owner=%U group=%G' /etc/kubernetes/manifests/kube-scheduler.yaml
           ```

        4. On every control plane node, verify the permissions now meet the benchmark (600 or more restrictive, e.g., 600, 640 not allowed, 400 allowed):
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/manifests/kube-scheduler.yaml
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on control plane nodes, so it cannot be used to fix `/etc/kubernetes/manifests/kube-scheduler.yaml`. This must be corrected directly on each control plane node’s filesystem; follow the guidance in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Purpose: Ensure kube-scheduler pod manifest file permissions are 600
        # Scope:   Run on every control plane node
        # Usage:   sudo /root/fix-kube-scheduler-perms.sh

        set -euo pipefail

        SCHEDULER_MANIFEST="/etc/kubernetes/manifests/kube-scheduler.yaml"
        DESIRED_MODE="600"

        echo "==> Checking for kube-scheduler manifest at ${SCHEDULER_MANIFEST}"

        if [ ! -e "${SCHEDULER_MANIFEST}" ]; then
          echo "File not found: ${SCHEDULER_MANIFEST}"
          echo "Nothing to change on this node."
          exit 0
        fi

        # Get current mode (numeric)
        CURRENT_MODE="$(stat -c '%a' "${SCHEDULER_MANIFEST}")"

        echo "Current permissions: ${CURRENT_MODE}"
        echo "Desired permissions: ${DESIRED_MODE}"

        if [ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]; then
          echo "Updating permissions to ${DESIRED_MODE} ..."
          chmod "${DESIRED_MODE}" "${SCHEDULER_MANIFEST}"
        else
          echo "Permissions already set to ${DESIRED_MODE}; no change needed."
        fi

        echo "==> Verifying permissions after change"
        VERIFY_OUT="$(stat -c 'permissions=%a' "${SCHEDULER_MANIFEST}")"
        echo "${VERIFY_OUT}"

        if [ "${VERIFY_OUT}" != "permissions=${DESIRED_MODE}" ]; then
          echo "ERROR: Verification failed; expected permissions=${DESIRED_MODE}" >&2
          exit 1
        fi

        echo "==> Success: kube-scheduler manifest permissions are ${DESIRED_MODE}"
        echo "Note: Editing files in /etc/kubernetes/manifests causes the kube-scheduler static pod to be restarted by the kubelet if contents change. A chmod alone should not restart it."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>