Skip to main content

Controller Manager Should Enable

More Info:​

Verifies that the RotateKubeletServerCertificate feature gate is enabled so kubelet serving certificates are automatically rotated before expiry.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current ownership of the controller manager manifest:

    stat -c '%n %U:%G' /etc/kubernetes/manifests/kube-controller-manager.yaml

  2. On every control plane node, change the file ownership to root:root:

    sudo chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml

  3. (Optional) Confirm file permissions are appropriate (no change, just inspect):

    ls -l /etc/kubernetes/manifests/kube-controller-manager.yaml

  4. Verify the fix on every control plane node using the benchmark’s audit command:

    /bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-controller-manager.yaml; then stat -c %U:%G /etc/kubernetes/manifests/kube-controller-manager.yaml; fi'

    The output must be:

    root:root
Using kubectl

kubectl cannot modify file ownership or other host-level settings for /etc/kubernetes/manifests/kube-controller-manager.yaml; this must be fixed directly on every control plane node’s filesystem. See the Manual Steps section for the exact chown command and verification steps to run over SSH.

Automation
#!/usr/bin/env bash
#
# Purpose: Ensure kube-controller-manager manifest ownership is root:root
# Scope:   Run on every control plane node
# Usage:   sudo ./fix-kcm-manifest-ownership.sh

set -euo pipefail

MANIFEST_PATH="/etc/kubernetes/manifests/kube-controller-manager.yaml"
DESIRED_OWNER="root"
DESIRED_GROUP="root"

echo "==> Checking for kube-controller-manager manifest at ${MANIFEST_PATH}"

if [ ! -e "${MANIFEST_PATH}" ]; then
  echo "Manifest not found at ${MANIFEST_PATH}; nothing to do on this node."
  exit 0
fi

current_owner="$(stat -c %U "${MANIFEST_PATH}")"
current_group="$(stat -c %G "${MANIFEST_PATH}")"
echo "Current ownership: ${current_owner}:${current_group}"

if [ "${current_owner}" = "${DESIRED_OWNER}" ] && [ "${current_group}" = "${DESIRED_GROUP}" ]; then
  echo "Ownership already correct: ${DESIRED_OWNER}:${DESIRED_GROUP}"
else
  echo "Fixing ownership to ${DESIRED_OWNER}:${DESIRED_GROUP}..."
  chown "${DESIRED_OWNER}:${DESIRED_GROUP}" "${MANIFEST_PATH}"
fi

echo "==> Verifying ownership..."

result="$(stat -c %U:%G "${MANIFEST_PATH}")"
echo "Post-fix ownership: ${result}"

if [ "${result}" != "${DESIRED_OWNER}:${DESIRED_GROUP}" ]; then
  echo "ERROR: Ownership is still incorrect. Expected ${DESIRED_OWNER}:${DESIRED_GROUP}, got ${result}" >&2
  exit 1
fi

echo "Ownership successfully set to ${DESIRED_OWNER}:${DESIRED_GROUP} on ${MANIFEST_PATH}"
exit 0