Skip to main content

Kubelet Kubeconfig File Ownership Set To root:root

More Info:​

The kubelet.conf kubeconfig file should be owned by root:root so only privileged users can access the kubelets API credentials. Incorrect ownership could expose those credentials.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check current ownership of the kubelet kubeconfig file:

    stat -c %U:%G /etc/kubernetes/kubelet.conf

  2. On every worker node, if ownership is not root:root, change it:

    chown root:root /etc/kubernetes/kubelet.conf

  3. On every worker node, ensure correct permissions are also set (optional but recommended: read/write for root only):

    chmod 600 /etc/kubernetes/kubelet.conf

  4. On every worker node, verify the ownership is now correct:

    stat -c %U:%G /etc/kubernetes/kubelet.conf
Using kubectl

kubectl cannot modify file ownership on nodes, so it cannot be used to fix /etc/kubernetes/kubelet.conf permissions. This change must be made directly on every worker node’s host filesystem; follow the guidance in the Manual Steps section to apply and verify the fix.

Automation
#!/usr/bin/env bash
#
# Fix CISKubernetes 4.1.6:
# Ensure /etc/kubernetes/kubelet.conf is owned by root:root
#
# Run on: every worker node (as root or with sudo)
# Safe to re-run.

set -euo pipefail

TARGET_FILE="/etc/kubernetes/kubelet.conf"

echo "==> Checking for ${TARGET_FILE}"

if [ ! -e "${TARGET_FILE}" ]; then
  echo "File ${TARGET_FILE} does not exist on this node. Nothing to do."
  exit 0
fi

current_owner_group="$(stat -c '%U:%G' "${TARGET_FILE}")"

if [ "${current_owner_group}" != "root:root" ]; then
  echo "Current ownership is ${current_owner_group}, fixing to root:root..."
  chown root:root "${TARGET_FILE}"
else
  echo "Ownership already correct (${current_owner_group}), no change needed."
fi

echo "==> Verifying ownership..."
verified_owner_group="$(stat -c '%U:%G' "${TARGET_FILE}")"
echo "Verified ownership: ${verified_owner_group}"

if [ "${verified_owner_group}" != "root:root" ]; then
  echo "ERROR: Failed to set ownership to root:root for ${TARGET_FILE}" >&2
  exit 1
fi

echo "==> Compliance check passed for ${TARGET_FILE}"