Skip to main content

Controller Manager Pod Specification File Permissions

More Info:​

Verifies that the kube-controller-manager pod manifest file has permissions of 600 or more restrictive. This prevents unauthorized modification of the controller manager configuration.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, confirm the controller manager manifest file exists and note its current permissions:

    sudo ls -l /etc/kubernetes/manifests/kube-controller-manager.yaml

  2. On every control plane node, set the file permissions to 600:

    sudo chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml

  3. (Optional) On every control plane node, set the file owner and group to root (if not already) to further restrict access:

    sudo chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml

  4. Be aware: modifying a static pod manifest under /etc/kubernetes/manifests may cause the kubelet to detect and restart the kube-controller-manager pod if it sees the file as changed. Perform this during a maintenance window if your environment is sensitive to control plane component restarts.

  5. On every control plane node, verify the permissions are now 600 or more restrictive:

    stat -c permissions=%a /etc/kubernetes/manifests/kube-controller-manager.yaml

    Confirm the output shows permissions=600 (or a more restrictive value such as permissions=400).

Using kubectl

kubectl cannot modify file permissions on control plane hosts, including /etc/kubernetes/manifests/kube-controller-manager.yaml. This must be fixed directly on every control plane node at the host level; follow the guidance in the Manual Steps section to update the file mode and verify it.

Automation
#!/usr/bin/env bash
#
# Fixes CIS Kubernetes 1.1.3:
# Ensures /etc/kubernetes/manifests/kube-controller-manager.yaml has permissions 600
# Run this on every control plane node.
# Safe to re-run (idempotent).

set -euo pipefail

TARGET_FILE="/etc/kubernetes/manifests/kube-controller-manager.yaml"
REQUIRED_MODE="600"
EXIT_CODE=0

echo "=== CIS 1.1.3: kube-controller-manager manifest permissions ==="

if [ ! -e "$TARGET_FILE" ]; then
  echo "SKIP: $TARGET_FILE does not exist on this node."
  exit 0
fi

# Show current permissions
CURRENT_MODE=$(stat -c '%a' "$TARGET_FILE")
echo "Current permissions for $TARGET_FILE: $CURRENT_MODE"

# Apply fix only if needed
if [ "$CURRENT_MODE" != "$REQUIRED_MODE" ]; then
  echo "Updating permissions to $REQUIRED_MODE ..."
  chmod "$REQUIRED_MODE" "$TARGET_FILE"
fi

# Verification (from benchmark audit logic)
VERIFY_OUTPUT=$(stat -c 'permissions=%a' "$TARGET_FILE")
echo "Verification: $VERIFY_OUTPUT"

if [ "$VERIFY_OUTPUT" != "permissions=$REQUIRED_MODE" ]; then
  echo "ERROR: Failed to set required permissions ($REQUIRED_MODE) on $TARGET_FILE" >&2
  EXIT_CODE=1
else
  echo "SUCCESS: $TARGET_FILE permissions are set to $REQUIRED_MODE"
fi

exit $EXIT_CODE