> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Scheduler Configuration File Permissions Are Restrictive

### More Info:

Ensure that the scheduler.conf file has permissions of 644 or more restrictive

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, check the current permissions of the scheduler configuration file:
           ```bash theme={null}
           stat -c permissions=%a /etc/kubernetes/scheduler.conf
           ```

        2. On every control plane node, set the file permissions to 644 as required:
           ```bash theme={null}
           chmod 644 /etc/kubernetes/scheduler.conf
           ```

        3. On every control plane node, optionally confirm the file owner and group (adjust with chown if needed according to your standard, e.g., root:root):
           ```bash theme={null}
           stat -c 'owner=%U group=%G' /etc/kubernetes/scheduler.conf
           ```

        4. On every control plane node, verify the fix using the audit command:
           ```bash theme={null}
           /bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c permissions=%a /etc/kubernetes/scheduler.conf; fi'
           ```
           Ensure the output shows `permissions=644` (or a more restrictive value such as 640 or 600).
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on control plane nodes, so it cannot be used to fix this finding on `/etc/kubernetes/scheduler.conf`. The required change must be made directly on every control plane node’s filesystem; see the Manual Steps section for the exact commands to run.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Automation: Fix permissions for /etc/kubernetes/scheduler.conf
        # Scope: Run on every control plane node
        # Idempotent: Safe to re-run; only adjusts permissions if needed.

        set -euo pipefail

        SCHED_CONF="/etc/kubernetes/scheduler.conf"
        DESIRED_MODE="644"

        echo "=== Checking for ${SCHED_CONF} ==="
        if [ ! -e "${SCHED_CONF}" ]; then
          echo "File not found: ${SCHED_CONF} (nothing to do on this node)"
          exit 0
        fi

        # Get current permissions (numeric, e.g. 640, 644, 600)
        CURRENT_MODE="$(stat -c '%a' "${SCHED_CONF}")"
        echo "Current permissions: ${CURRENT_MODE}"

        # Compare and only change if more permissive than desired
        # Any mode numerically greater than 644 is considered more permissive here
        if [ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]; then
          echo "Setting permissions to ${DESIRED_MODE} on ${SCHED_CONF}"
          chmod "${DESIRED_MODE}" "${SCHED_CONF}"
        else
          echo "Permissions already set to ${DESIRED_MODE}; no change needed"
        fi

        echo "=== Verifying remediation ==="
        /bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c permissions=%a /etc/kubernetes/scheduler.conf; fi'
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/)