Skip to main content

Kubelet config.yaml File Ownership Set To root:root

More Info:​

When a kubelet config.yaml file is in use it should be owned by root:root so only privileged users can alter the kubelet configuration. Incorrect ownership risks unauthorized changes to node security.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, confirm whether the kubelet config file exists and view its current ownership:

    sudo ls -l /var/lib/kubelet/config.yaml

  2. On every worker node, set the ownership of the kubelet config file to root:root as required:

    sudo chown root:root /var/lib/kubelet/config.yaml

  3. On every worker node, verify that the ownership is now correctly set:

    sudo stat -c %U:%G /var/lib/kubelet/config.yaml

    The output must be:

    root:root
Using kubectl

kubectl cannot change file ownership on nodes, including /var/lib/kubelet/config.yaml; this must be fixed directly on every worker node’s host filesystem. See the Manual Steps section for the exact chown command and how to verify the fix.

Automation
#!/usr/bin/env bash
#
# Remediate CIS Kubernetes 4.1.10:
# Ensure /var/lib/kubelet/config.yaml (if present) is owned by root:root
#
# Run this script on every worker node with root privileges.
# It is safe to re-run.

set -euo pipefail

CONFIG_PATH="/var/lib/kubelet/config.yaml"

echo "=== CIS 4.1.10 remediation: kubelet config.yaml ownership ==="

if [ ! -e "$CONFIG_PATH" ]; then
  echo "INFO: $CONFIG_PATH does not exist on this node. Nothing to do."
  exit 0
fi

current_owner="$(stat -c '%U:%G' "$CONFIG_PATH")"
echo "Current ownership of $CONFIG_PATH: $current_owner"

if [ "$current_owner" != "root:root" ]; then
  echo "Changing ownership of $CONFIG_PATH to root:root ..."
  chown root:root "$CONFIG_PATH"
else
  echo "Ownership already set to root:root, no change needed."
fi

# Verification (from benchmark audit command)
echo "Verifying ownership..."
verified_owner="$(stat -c '%U:%G' "$CONFIG_PATH")"
echo "Verified ownership of $CONFIG_PATH: $verified_owner"

if [ "$verified_owner" != "root:root" ]; then
  echo "ERROR: Failed to set ownership of $CONFIG_PATH to root:root" >&2
  exit 1
fi

echo "SUCCESS: $CONFIG_PATH ownership is correctly set to root:root."