Skip to main content

Ensure Scheduler Configuration File Ownership Is Root

More Info:​

Ensure that the scheduler.conf file ownership is set to root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current ownership of the scheduler configuration file:

    stat -c %U:%G /etc/kubernetes/scheduler.conf

  2. On every control plane node, change the ownership of the file to root:root:

    sudo chown root:root /etc/kubernetes/scheduler.conf

  3. (Optional, if using strict permissions) On every control plane node, ensure permissions are not overly permissive:

    sudo chmod 600 /etc/kubernetes/scheduler.conf

  4. On every control plane node, verify the ownership is now correct:

    stat -c %U:%G /etc/kubernetes/scheduler.conf

    The output must be:

    root:root
Using kubectl

kubectl cannot change file ownership on control plane nodes, including /etc/kubernetes/scheduler.conf; this must be fixed directly on each control plane host via OS-level commands. See the Manual Steps section for the exact chown command and verification steps to run over SSH.

Automation
#!/usr/bin/env bash
# Automation: Enforce root:root ownership on /etc/kubernetes/scheduler.conf
# Scope: Run on every control plane node
# Usage: sudo ./fix-scheduler-conf-ownership.sh

set -euo pipefail

SCHED_CONF="/etc/kubernetes/scheduler.conf"
DESIRED_OWNER="root"
DESIRED_GROUP="root"

echo "=== Ensuring ownership of ${SCHED_CONF} is ${DESIRED_OWNER}:${DESIRED_GROUP} ==="

if [ ! -e "${SCHED_CONF}" ]; then
  echo "File not found: ${SCHED_CONF}"
  echo "Nothing to change on this node."
  exit 0
fi

# Current ownership
CURRENT_OWNER="$(stat -c %U "${SCHED_CONF}")"
CURRENT_GROUP="$(stat -c %G "${SCHED_CONF}")"

echo "Current ownership: ${CURRENT_OWNER}:${CURRENT_GROUP}"

# Apply fix only if needed (idempotent)
if [ "${CURRENT_OWNER}" != "${DESIRED_OWNER}" ] || [ "${CURRENT_GROUP}" != "${DESIRED_GROUP}" ]; then
  echo "Updating ownership to ${DESIRED_OWNER}:${DESIRED_GROUP}..."
  chown "${DESIRED_OWNER}:${DESIRED_GROUP}" "${SCHED_CONF}"
else
  echo "Ownership already correct. No change needed."
fi

# Verification (as per audit command)
echo "=== Verifying ownership ==="
/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c %U:%G /etc/kubernetes/scheduler.conf; fi'

RESULT="$(stat -c %U:%G "${SCHED_CONF}")"
if [ "${RESULT}" = "${DESIRED_OWNER}:${DESIRED_GROUP}" ]; then
  echo "SUCCESS: Ownership is correctly set to ${RESULT}"
  exit 0
else
  echo "ERROR: Ownership is ${RESULT}, expected ${DESIRED_OWNER}:${DESIRED_GROUP}" >&2
  exit 1
fi

Additional Reading:​