Skip to main content

Etcd Pod Specification File Ownership Should Be root:root

More Info:​

Verifies that the etcd pod manifest file is owned by root:root so only privileged users can modify the datastore configuration.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, confirm the etcd manifest file exists and see its current ownership:

    ls -l /etc/kubernetes/manifests/etcd.yaml

  2. On every control plane node, set the file owner and group to root:root:

    sudo chown root:root /etc/kubernetes/manifests/etcd.yaml

  3. (Optional) Re-list the file to visually confirm ownership:

    ls -l /etc/kubernetes/manifests/etcd.yaml

  4. On every control plane node, verify the fix using the audit-style command:

    /bin/sh -c 'if test -e /etc/kubernetes/manifests/etcd.yaml; then find /etc/kubernetes/manifests/etcd.yaml -name "*etcd*" | xargs stat -c %U:%G; fi'

    The output must be:

    root:root
Using kubectl

kubectl cannot modify file ownership on the host filesystem where the etcd static pod manifest (/etc/kubernetes/manifests/etcd.yaml) resides. This finding must be remediated directly on every control plane node’s OS; see the Manual Steps section for the required commands and procedure.

Automation
#!/usr/bin/env bash
#
# Fix ownership of the etcd static pod manifest so it is root:root
# Scope: run on every control plane node (as root)
set -euo pipefail

ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"

echo "==> Checking for etcd manifest at ${ETCD_MANIFEST}"

if [[ ! -e "${ETCD_MANIFEST}" ]]; then
  echo "Etcd manifest not found at ${ETCD_MANIFEST}; nothing to do on this node."
  exit 0
fi

current_owner="$(stat -c '%U:%G' "${ETCD_MANIFEST}")"

echo "Current ownership: ${current_owner}"

if [[ "${current_owner}" != "root:root" ]]; then
  echo "Fixing ownership to root:root"
  chown root:root "${ETCD_MANIFEST}"
else
  echo "Ownership already set to root:root; no change needed."
fi

echo "==> Verifying fix"
stat -c '%U:%G %n' "${ETCD_MANIFEST}"

echo
echo "==> CIS 1.1.8 verification (should output 'root:root'):"
/bin/sh -c 'if test -e /etc/kubernetes/manifests/etcd.yaml; then find /etc/kubernetes/manifests/etcd.yaml -name "*etcd*" | xargs stat -c %U:%G; fi'