Skip to main content

Kubelet Service File Ownership Set To root:root

More Info:​

The kubelet service file should be owned by root:root so that only privileged users can alter it. Incorrect ownership could allow unauthorized modification of the kubelet startup.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, verify the current ownership of the kubelet service file:

    stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

  2. On every worker node, set the ownership of the kubelet service file to root:root:

    sudo chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

  3. On every worker node, confirm the change took effect (verification):

    /bin/sh -c "if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; else echo \"File not found\"; fi"
Using kubectl

kubectl cannot modify host-level systemd unit files such as /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on worker nodes; the ownership must be corrected directly on each node’s OS. Please follow the guidance in the Manual Steps section on every worker node to fix the file ownership and then re-run the audit command to verify.

Automation
#!/usr/bin/env bash
#
# Fix CISKubernetes 4.1.2:
# Ensure kubelet service file ownership is set to root:root
#
# Usage:
#   1) Copy this script to every worker node (or run via SSH/Ansible).
#   2) Run as root:  sudo bash ./fix-kubelet-service-ownership.sh

set -euo pipefail

KUBELET_UNIT_OVERRIDE="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"

echo "[INFO] Checking kubelet service file on this node: ${KUBELET_UNIT_OVERRIDE}"

if [ ! -e "${KUBELET_UNIT_OVERRIDE}" ]; then
  echo "[WARN] File not found: ${KUBELET_UNIT_OVERRIDE}"
  echo "[WARN] Nothing to change on this node."
  exit 0
fi

# Current ownership
current_owner_group="$(stat -c '%U:%G' "${KUBELET_UNIT_OVERRIDE}")" || {
  echo "[ERROR] Failed to stat ${KUBELET_UNIT_OVERRIDE}"
  exit 1
}

echo "[INFO] Current ownership: ${current_owner_group}"

# Only change if needed (idempotent)
if [ "${current_owner_group}" != "root:root" ]; then
  echo "[INFO] Updating ownership to root:root"
  chown root:root "${KUBELET_UNIT_OVERRIDE}"
else
  echo "[INFO] Ownership already root:root; no change needed."
fi

# Verification (as per audit command)
echo "[INFO] Verifying ownership after change:"
audit_result="$(
  /bin/sh -c "if test -e ${KUBELET_UNIT_OVERRIDE}; then stat -c %U:%G ${KUBELET_UNIT_OVERRIDE}; else echo 'File not found'; fi"
)"

echo "[INFO] Audit output: ${audit_result}"

if [ "${audit_result}" != "root:root" ]; then
  echo "[ERROR] Verification failed: expected root:root, got ${audit_result}"
  exit 1
fi

echo "[INFO] Verification successful: kubelet service file is owned by root:root"
exit 0