> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Scheduler Configuration File Ownership Is Root

### More Info:

Ensure that the scheduler.conf file ownership is set to root:root.

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, check the current ownership of the scheduler configuration file:
           ```sh theme={null}
           stat -c %U:%G /etc/kubernetes/scheduler.conf
           ```

        2. On every control plane node, change the ownership of the file to root:root:
           ```sh theme={null}
           sudo chown root:root /etc/kubernetes/scheduler.conf
           ```

        3. (Optional, if using strict permissions) On every control plane node, ensure permissions are not overly permissive:
           ```sh theme={null}
           sudo chmod 600 /etc/kubernetes/scheduler.conf
           ```

        4. On every control plane node, verify the ownership is now correct:
           ```sh theme={null}
           stat -c %U:%G /etc/kubernetes/scheduler.conf
           ```
           The output must be:
           ```text theme={null}
           root:root
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change file ownership on control plane nodes, including `/etc/kubernetes/scheduler.conf`; this must be fixed directly on each control plane host via OS-level commands. See the Manual Steps section for the exact `chown` command and verification steps to run over SSH.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Automation: Enforce root:root ownership on /etc/kubernetes/scheduler.conf
        # Scope: Run on every control plane node
        # Usage: sudo ./fix-scheduler-conf-ownership.sh

        set -euo pipefail

        SCHED_CONF="/etc/kubernetes/scheduler.conf"
        DESIRED_OWNER="root"
        DESIRED_GROUP="root"

        echo "=== Ensuring ownership of ${SCHED_CONF} is ${DESIRED_OWNER}:${DESIRED_GROUP} ==="

        if [ ! -e "${SCHED_CONF}" ]; then
          echo "File not found: ${SCHED_CONF}"
          echo "Nothing to change on this node."
          exit 0
        fi

        # Current ownership
        CURRENT_OWNER="$(stat -c %U "${SCHED_CONF}")"
        CURRENT_GROUP="$(stat -c %G "${SCHED_CONF}")"

        echo "Current ownership: ${CURRENT_OWNER}:${CURRENT_GROUP}"

        # Apply fix only if needed (idempotent)
        if [ "${CURRENT_OWNER}" != "${DESIRED_OWNER}" ] || [ "${CURRENT_GROUP}" != "${DESIRED_GROUP}" ]; then
          echo "Updating ownership to ${DESIRED_OWNER}:${DESIRED_GROUP}..."
          chown "${DESIRED_OWNER}:${DESIRED_GROUP}" "${SCHED_CONF}"
        else
          echo "Ownership already correct. No change needed."
        fi

        # Verification (as per audit command)
        echo "=== Verifying ownership ==="
        /bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c %U:%G /etc/kubernetes/scheduler.conf; fi'

        RESULT="$(stat -c %U:%G "${SCHED_CONF}")"
        if [ "${RESULT}" = "${DESIRED_OWNER}:${DESIRED_GROUP}" ]; then
          echo "SUCCESS: Ownership is correctly set to ${RESULT}"
          exit 0
        else
          echo "ERROR: Ownership is ${RESULT}, expected ${DESIRED_OWNER}:${DESIRED_GROUP}" >&2
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kubeadm/](https://kubernetes.io/docs/admin/kubeadm/)