Skip to main content

Controller Manager Should Set Root CA File

More Info:​

Verifies that --root-ca-file is set so the controller manager injects a trusted CA bundle into pods, letting them verify the API server certificate.

Risk Level​

High

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current ownership of the file:

    stat -c %U:%G /etc/kubernetes/controller-manager.conf

  2. On every control plane node, set the correct ownership to root:root:

    sudo chown root:root /etc/kubernetes/controller-manager.conf

  3. (Optional) If the file might be a symlink, ensure the ownership is correct on the target as well:

    sudo chown -h root:root /etc/kubernetes/controller-manager.conf

  4. Verify the fix on every control plane node:

    /bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c %U:%G /etc/kubernetes/controller-manager.conf; fi'

    The output must be:

    root:root
Using kubectl

kubectl cannot change ownership or permissions of host-level files such as /etc/kubernetes/controller-manager.conf on control plane nodes. This fix must be done directly on each control plane node’s filesystem; see the Manual Steps section for the exact commands and procedure.

Automation
#!/usr/bin/env bash
#
# Remediation: Ensure /etc/kubernetes/controller-manager.conf ownership is root:root
# Scope: Run on every control plane node
# Safe to re-run; no service restarts required.

set -euo pipefail

CONFIG_PATH="/etc/kubernetes/controller-manager.conf"

echo "=== [INFO] Starting remediation for controller-manager.conf ownership ==="

if [ ! -e "$CONFIG_PATH" ]; then
  echo "=== [WARN] $CONFIG_PATH does not exist on this node; nothing to do. ==="
  exit 0
fi

current_owner_group="$(stat -c '%U:%G' "$CONFIG_PATH")"

if [ "$current_owner_group" = "root:root" ]; then
  echo "=== [OK] Ownership already correct: $CONFIG_PATH is root:root ==="
else
  echo "=== [INFO] Current ownership is $current_owner_group, changing to root:root ==="
  chown root:root "$CONFIG_PATH"
fi

echo "=== [INFO] Verifying remediation ==="
/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c %U:%G /etc/kubernetes/controller-manager.conf; fi'

verified_owner_group="$(stat -c '%U:%G' "$CONFIG_PATH")"
if [ "$verified_owner_group" != "root:root" ]; then
  echo "=== [ERROR] Verification failed: expected root:root, got $verified_owner_group ==="
  exit 1
fi

echo "=== [SUCCESS] $CONFIG_PATH ownership is correctly set to root:root ==="