Default Administrative Credential File Permissions Should

More Info:

Verifies that admin.conf and super-admin.conf kubeconfig files have permissions of 600. These files grant cluster-admin access and must not be readable by other users.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS Kubernetes

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every control plane node, check the current permissions of the default admin kubeconfig files:

   for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
     if test -e "$adminconf"; then
       stat -c "permissions=%a %n" "$adminconf"
     fi
   done

2. On every control plane node, restrict permissions on admin.conf so only the owner can read and write it:

   if test -e /etc/kubernetes/admin.conf; then
     chmod 600 /etc/kubernetes/admin.conf
   fi

3. On every control plane node running Kubernetes 1.29 or later, also restrict permissions on super-admin.conf (if present):

   if test -e /etc/kubernetes/super-admin.conf; then
     chmod 600 /etc/kubernetes/super-admin.conf
   fi

4. On every control plane node, confirm that only the intended user (typically root) owns these files and that group/others do not have access:

   for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
     if test -e "$adminconf"; then
       ls -l "$adminconf"
     fi
   done

5. On every control plane node, re-run the permissions check to verify remediation:

   for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
     if test -e "$adminconf"; then
       stat -c "permissions=%a %n" "$adminconf"
     fi
   done

Using kubectl

kubectl cannot modify file permissions on control plane nodes, so it cannot be used to fix /etc/kubernetes/admin.conf or /etc/kubernetes/super-admin.conf. File mode changes must be made directly on each control plane node’s filesystem; see the Manual Steps section for the exact commands to run over SSH.

Automation

#!/usr/bin/env bash
# Fix CIS Kubernetes 1.1.13: ensure admin.conf and super-admin.conf are 600
# Run on every control plane node (as root).

set -euo pipefail

ADMIN_FILES=(
  "/etc/kubernetes/admin.conf"
  "/etc/kubernetes/super-admin.conf"
)

changed=0

echo "==> Ensuring permissions 600 on default administrative kubeconfig files"

for f in "${ADMIN_FILES[@]}"; do
  if [ -e "$f" ]; then
    current_perm=$(stat -c "%a" "$f")
    if [ "$current_perm" != "600" ]; then
      echo " - Updating $f permissions from $current_perm to 600"
      chmod 600 "$f"
      changed=1
    else
      echo " - $f already has permissions 600"
    fi
  else
    echo " - $f does not exist on this node, skipping"
  fi
done

echo
echo "==> Verifying resulting permissions"
for f in "${ADMIN_FILES[@]}"; do
  if [ -e "$f" ]; then
    stat -c "permissions=%a %n" "$f"
  fi
done

if [ "$changed" -eq 0 ]; then
  echo "==> No changes were necessary; all existing files already compliant."
else
  echo "==> Permissions updated where necessary."
fi