Skip to main content

Etcd Pod Specification File Permissions Should Be 600 Or

More Info:​

Verifies that the etcd pod manifest file has permissions of 600 or more restrictive to protect the datastore configuration.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current permissions of the etcd manifest file:

    stat -c 'File: %n  Permissions: %a (%A)' /etc/kubernetes/manifests/etcd.yaml

  2. On every control plane node, set the permissions of the etcd manifest file to 600:

    chmod 600 /etc/kubernetes/manifests/etcd.yaml

  3. (Optional, on every control plane node) Set the file owner and group to root (if not already):

    chown root:root /etc/kubernetes/manifests/etcd.yaml

  4. On every control plane node, verify the permissions are now 600 or more restrictive:

    /bin/sh -c 'if test -e /etc/kubernetes/manifests/etcd.yaml; then find /etc/kubernetes/manifests/etcd.yaml -name "*etcd*" | xargs stat -c permissions=%a; fi'

    Ensure the output shows:

    permissions=600
Using kubectl

kubectl cannot modify file permissions on control plane nodes, so it cannot fix the permissions on /etc/kubernetes/manifests/etcd.yaml. This must be corrected directly on every control plane node’s filesystem; see the Manual Steps section for the required host-level commands.

Automation
#!/usr/bin/env bash
#
# Remediate CIS Kubernetes 1.1.7:
# Ensure that the etcd pod specification file permissions are set to 600 or more restrictive.
#
# Run on: every control plane node (with root or sudo access).
# Safe to re-run (idempotent).

set -euo pipefail

ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"
DESIRED_MODE="600"

echo "=== CIS 1.1.7: Fix etcd manifest permissions on this control plane node ==="

if [[ ! -e "$ETCD_MANIFEST" ]]; then
  echo "Etcd manifest not found at $ETCD_MANIFEST – nothing to do on this node."
  exit 0
fi

# Show current permissions
CURRENT_MODE="$(stat -c '%a' "$ETCD_MANIFEST" || echo 'unknown')"
echo "Current permissions on $ETCD_MANIFEST: $CURRENT_MODE"

# Apply fix (idempotent: chmod 600 is safe repeatedly)
echo "Setting permissions on $ETCD_MANIFEST to $DESIRED_MODE ..."
chmod "$DESIRED_MODE" "$ETCD_MANIFEST"

# Verification using the benchmark's audit logic
echo "Verifying permissions using audit-style command..."
VERIFY_OUTPUT="$(/bin/sh -c "if test -e $ETCD_MANIFEST; then find $ETCD_MANIFEST -name '*etcd*' | xargs stat -c permissions=%a; fi")"

echo "Audit output:"
echo "$VERIFY_OUTPUT"

# Parse verification result: expect permissions=600
if echo "$VERIFY_OUTPUT" | grep -q "permissions=${DESIRED_MODE}\b"; then
  echo "SUCCESS: $ETCD_MANIFEST permissions are set to $DESIRED_MODE as required."
  exit 0
else
  echo "ERROR: $ETCD_MANIFEST permissions are not correctly set. Please investigate manually."
  exit 1
fi