Certificate Authorities File Permissions Set To 644 Or More

More Info:

The kubelet client certificate authorities file is used to validate client certificates and should not be writable by non-privileged users. Permissions of 644 or more restrictive protect its integrity.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS Kubernetes

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every worker node, identify the kubelet client CA file path (in case it differs from the default):

   ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file=

   If no --client-ca-file flag is present, the default path is /etc/kubernetes/pki/ca.crt.

2. On every worker node, set the permissions of the CA file to 644 (readable by all, writable only by owner). Use the actual path if different from the default:

   chmod 644 /etc/kubernetes/pki/ca.crt

3. On every worker node, confirm the owner and group are appropriate for your environment (commonly root:root), adjusting if necessary:

   ls -l /etc/kubernetes/pki/ca.crt

   If you need to change ownership (example for root:root):

   chown root:root /etc/kubernetes/pki/ca.crt

4. On every worker node, verify the permissions now meet the benchmark (644 or more restrictive), using an adapted version of the audit command:

   CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
   if test -z "$CAFILE"; then CAFILE=/etc/kubernetes/pki/ca.crt; fi
   if test -e "$CAFILE"; then stat -c permissions=%a "$CAFILE"; fi

   Ensure the output shows permissions=644 or a more restrictive value (e.g., 600, 640).

Using kubectl

kubectl cannot modify file permissions on worker node files such as /etc/kubernetes/pki/ca.crt; this must be fixed directly on each worker node’s host filesystem. Use the guidance in the Manual Steps section on every worker node to set the correct permissions and then re-run the audit command to verify.

Automation

#!/usr/bin/env bash
#
# Purpose: Ensure kubelet client CA file permissions are 644 or more restrictive
# Scope:   Run on every worker node
# Safe:    Idempotent; can be re-run
#

set -euo pipefail

echo "==> Detecting kubelet client CA file..."

CAFILE="$(
  ps -ef \
    | grep kubelet \
    | grep -v apiserver \
    | grep -- '--client-ca-file=' \
    | awk -F '--client-ca-file=' '{print $2}' \
    | awk '{print $1}' \
    | uniq
)"

if [ -z "${CAFILE}" ]; then
  CAFILE="/etc/kubernetes/pki/ca.crt"
fi

if [ ! -e "${CAFILE}" ]; then
  echo "ERROR: Client CA file not found at ${CAFILE}. Nothing changed."
  exit 1
fi

echo "==> Using client CA file: ${CAFILE}"

# Get current permissions in numeric form (e.g. 640, 644, 600)
CURRENT_PERMS="$(stat -c '%a' "${CAFILE}")"
echo "==> Current permissions: ${CURRENT_PERMS}"

TARGET_PERMS="644"

if [ "${CURRENT_PERMS}" != "${TARGET_PERMS}" ]; then
  echo "==> Setting permissions to ${TARGET_PERMS} on ${CAFILE}"
  chmod "${TARGET_PERMS}" "${CAFILE}"
else
  echo "==> Permissions already ${TARGET_PERMS}; no change needed."
fi

echo "==> Verifying permissions..."

# Re-run the benchmark audit logic to confirm

CAFILE_VERIFY="$(
  ps -ef \
    | grep kubelet \
    | grep -v apiserver \
    | grep -- '--client-ca-file=' \
    | awk -F '--client-ca-file=' '{print $2}' \
    | awk '{print $1}' \
    | uniq
)"

if [ -z "${CAFILE_VERIFY}" ]; then
  CAFILE_VERIFY="/etc/kubernetes/pki/ca.crt"
fi

if [ -e "${CAFILE_VERIFY}" ]; then
  PERMS_VERIFY="$(stat -c 'permissions=%a' "${CAFILE_VERIFY}")"
  echo "==> Audit result: ${PERMS_VERIFY}"
else
  echo "ERROR: Verification failed; file ${CAFILE_VERIFY} not found."
  exit 1
fi

if [ "${PERMS_VERIFY}" != "permissions=644" ]; then
  echo "ERROR: Expected permissions=644 but got ${PERMS_VERIFY}"
  exit 1
fi

echo "==> Success: kubelet client CA file permissions are set to 644."