Default Administrative Credential File Ownership Should Be

More Info:

Verifies that admin.conf and super-admin.conf kubeconfig files are owned by root:root so only privileged users can read the cluster-admin credentials.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS Kubernetes

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every control plane node, check current ownership of the admin kubeconfig files:

for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
  if test -e "$adminconf"; then
    stat -c "ownership=%U:%G %n" "$adminconf"
  fi
done

2. On every control plane node, change ownership of /etc/kubernetes/admin.conf to root:root if the file exists:

if test -e /etc/kubernetes/admin.conf; then
  chown root:root /etc/kubernetes/admin.conf
fi

3. On every control plane node, change ownership of /etc/kubernetes/super-admin.conf to root:root if the file exists (especially on Kubernetes v1.29+):

if test -e /etc/kubernetes/super-admin.conf; then
  chown root:root /etc/kubernetes/super-admin.conf
fi

4. Verify the fix on every control plane node:

for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
  if test -e "$adminconf"; then
    stat -c "ownership=%U:%G %n" "$adminconf"
  fi
done

Using kubectl

kubectl cannot modify file ownership on control plane hosts, so it cannot be used to fix /etc/kubernetes/admin.conf or /etc/kubernetes/super-admin.conf. Change ownership directly on every control plane node’s filesystem, as described in the Manual Steps section.

Automation

#!/usr/bin/env bash
#
# Remediate CIS Kubernetes 1.1.14:
# Ensure /etc/kubernetes/admin.conf and /etc/kubernetes/super-admin.conf
# are owned by root:root on every control plane node.
#
# Run this script as root on each control plane node.
set -euo pipefail

FILES=(
  "/etc/kubernetes/admin.conf"
  "/etc/kubernetes/super-admin.conf"
)

changed=0

echo "==> Ensuring ownership is root:root for default administrative kubeconfig files"

for f in "${FILES[@]}"; do
  if [ -e "$f" ]; then
    # Get current ownership in user:group form
    current_owner="$(stat -c '%U:%G' "$f")"
    if [ "$current_owner" != "root:root" ]; then
      echo " - Fixing ownership on $f (was $current_owner, setting to root:root)"
      chown root:root "$f"
      changed=1
    else
      echo " - Ownership already correct on $f (root:root)"
    fi
  else
    echo " - File not present, skipping: $f"
  fi
done

if [ "$changed" -eq 0 ]; then
  echo "==> No changes were necessary."
else
  echo "==> Ownership updated where required."
fi

echo
echo "==> Verifying ownership:"
for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
  if test -e "$adminconf"; then
    stat -c "ownership=%U:%G %n" "$adminconf"
  fi
done