Skip to main content

Ensure Scheduler Pod Specification File Ownership Is Root

More Info:​

Ensure that the scheduler pod specification file ownership is set to root:root

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check current ownership of the scheduler manifest:

    stat -c %U:%G /etc/kubernetes/manifests/kube-scheduler.yaml

  2. On every control plane node, set the file owner and group to root:

    sudo chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml

  3. (Optional) Confirm file permissions are at least not more permissive than needed (no change required for this control, but you may review):

    ls -l /etc/kubernetes/manifests/kube-scheduler.yaml

  4. Verify the fix on every control plane node using the audit command:

    /bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-scheduler.yaml; then stat -c %U:%G /etc/kubernetes/manifests/kube-scheduler.yaml; fi'

    The output must be:

    root:root
Using kubectl

kubectl cannot modify ownership of host-level files such as /etc/kubernetes/manifests/kube-scheduler.yaml on control plane nodes. This must be fixed directly on each control plane node’s filesystem; see the Manual Steps section for the exact commands to run over SSH.

Automation
#!/usr/bin/env bash
#
# Fix ownership of kube-scheduler pod specification file to root:root
# Applies on: every control plane node
# Safe to re-run (idempotent)

set -euo pipefail

SCHEDULER_MANIFEST="/etc/kubernetes/manifests/kube-scheduler.yaml"

echo "==> Checking for kube-scheduler manifest at ${SCHEDULER_MANIFEST}"

if [ ! -e "${SCHEDULER_MANIFEST}" ]; then
  echo "WARNING: ${SCHEDULER_MANIFEST} not found on this node. Nothing to do."
  exit 0
fi

# Show current ownership
current_owner="$(stat -c '%U:%G' "${SCHEDULER_MANIFEST}")"
echo "Current ownership: ${current_owner}"

# Only change if not already root:root
if [ "${current_owner}" != "root:root" ]; then
  echo "Updating ownership to root:root ..."
  chown root:root "${SCHEDULER_MANIFEST}"
else
  echo "Ownership already set to root:root, no change needed."
fi

# Verification (re-run audit)
echo "==> Verifying ownership..."
verified_owner="$(stat -c '%U:%G' "${SCHEDULER_MANIFEST}")"
echo "Verified ownership: ${verified_owner}"

if [ "${verified_owner}" != "root:root" ]; then
  echo "ERROR: Failed to set ownership to root:root on ${SCHEDULER_MANIFEST}" >&2
  exit 1
fi

echo "SUCCESS: ${SCHEDULER_MANIFEST} ownership is correctly set to root:root"

Run this script on every control plane node with sufficient privileges, for example:

sudo bash fix-kube-scheduler-ownership.sh

Additional Reading:​