Skip to main content

Controller Manager Kubeconfig File Permissions Should Be

More Info:​

Verifies that the controller-manager.conf kubeconfig file has permissions of 600 or more restrictive to protect the controller managers client credentials.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. Check current permissions (run on every control plane node):

    stat -c 'permissions=%a  file=%n' /etc/kubernetes/controller-manager.conf

  2. Set restrictive permissions (600) (run on every control plane node):

    chmod 600 /etc/kubernetes/controller-manager.conf

  3. Set secure ownership (root:root) if needed (run on every control plane node):

    chown root:root /etc/kubernetes/controller-manager.conf

  4. Verify final permissions (run on every control plane node):

    stat -c 'permissions=%a  owner=%U  group=%G  file=%n' /etc/kubernetes/controller-manager.conf

    Confirm that permissions=600 and owner=root group=root.

Using kubectl

kubectl cannot modify file permissions on control plane nodes, so it cannot be used to fix /etc/kubernetes/controller-manager.conf. Apply the remediation directly on every control plane node’s host OS as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
#
# Fixes CIS Kubernetes 1.1.17:
# Ensures /etc/kubernetes/controller-manager.conf has file mode 600 (or more restrictive).
#
# Run on: every control plane node
# Usage: sudo ./fix-controller-manager-kubeconfig-perms.sh

set -euo pipefail

TARGET_FILE="/etc/kubernetes/controller-manager.conf"
DESIRED_MODE="600"

echo "[INFO] Checking for ${TARGET_FILE}"

if [ ! -e "${TARGET_FILE}" ]; then
  echo "[WARN] ${TARGET_FILE} does not exist on this node. Nothing to do."
else
  # Get current permissions in octal (e.g. 640, 600, 444)
  CURRENT_MODE="$(stat -c '%a' "${TARGET_FILE}")"

  echo "[INFO] Current mode for ${TARGET_FILE}: ${CURRENT_MODE}"

  if [ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]; then
    echo "[INFO] Setting mode ${DESIRED_MODE} on ${TARGET_FILE}"
    chmod "${DESIRED_MODE}" "${TARGET_FILE}"
  else
    echo "[INFO] Mode already ${DESIRED_MODE}; no change needed."
  fi

  # Verification (adapted from the audit command)
  echo "[INFO] Verifying permissions:"
  stat -c 'permissions=%a path=%n' "${TARGET_FILE}"

  FINAL_MODE="$(stat -c '%a' "${TARGET_FILE}")"
  if [ "${FINAL_MODE}" != "${DESIRED_MODE}" ]; then
    echo "[ERROR] Failed to enforce mode ${DESIRED_MODE} on ${TARGET_FILE} (current: ${FINAL_MODE})" >&2
    exit 1
  fi

  echo "[INFO] Verification successful: ${TARGET_FILE} is set to ${DESIRED_MODE}"
fi