Skip to main content

Kubelet config.yaml File Permissions Set To 600 Or More

More Info:​

When a kubelet config.yaml file is in use it defines the kubelets security settings and should be protected from modification. Permissions of 600 or more restrictive keep it readable only by root.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, verify that the kubelet config file exists and note its current permissions:

    ls -l /var/lib/kubelet/config.yaml

  2. On every worker node, set the file permissions to 600 as required:

    chmod 600 /var/lib/kubelet/config.yaml

  3. On every worker node, ensure the file is owned by root (optional hardening but commonly expected):

    chown root:root /var/lib/kubelet/config.yaml

  4. On every worker node, verify the permissions are now 600 or more restrictive:

    stat -c permissions=%a /var/lib/kubelet/config.yaml
Using kubectl

kubectl cannot modify host-level file permissions such as /var/lib/kubelet/config.yaml on worker nodes. This fix must be performed directly on every worker node (for example over SSH); see the Manual Steps section for the exact commands to run.

Automation
#!/usr/bin/env bash
#
# Remediate CIS Kubernetes 4.1.9:
# Ensure /var/lib/kubelet/config.yaml permissions are 600 or more restrictive
# Scope: run on every worker node (can also be run on control plane nodes; it
#        will only act if the file exists).
set -euo pipefail

CONFIG_PATH="/var/lib/kubelet/config.yaml"
DESIRED_MODE="600"

echo "==> CIS 4.1.9: Ensuring ${CONFIG_PATH} permissions are ${DESIRED_MODE} on this node"

if [ ! -e "${CONFIG_PATH}" ]; then
  echo "    File not found: ${CONFIG_PATH} (nothing to do on this node)"
else
  # Get current mode without leading zeros (e.g. 600, 640, 644)
  CURRENT_MODE="$(stat -c '%a' "${CONFIG_PATH}")"

  if [ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]; then
    echo "    Current mode is ${CURRENT_MODE}, setting to ${DESIRED_MODE}"
    chmod "${DESIRED_MODE}" "${CONFIG_PATH}"
  else
    echo "    Mode already ${DESIRED_MODE}, no change needed"
  fi

  # Verification step (from the audit command)
  echo "==> Verifying permissions"
  /bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c permissions=%a /var/lib/kubelet/config.yaml; fi'
fi

echo "==> Completed CIS 4.1.9 remediation on this node"

Usage:

  • Copy this script to a file, for example on any machine with SSH access to the nodes:
    • /tmp/fix-kubelet-config-perms.sh
  • Distribute and run it on every worker node (and any other node that may run a kubelet):
# From your admin machine, example with SSH (adjust hostnames/IPs and user)
for NODE in worker1 worker2 worker3; do
  echo "=== ${NODE} ==="
  scp /tmp/fix-kubelet-config-perms.sh "${NODE}:/tmp/fix-kubelet-config-perms.sh"
  ssh "${NODE}" "sudo bash /tmp/fix-kubelet-config-perms.sh"
done

The script is idempotent: re-running it will only change permissions if they are not already 600, and it always prints the final stat output as verification.