Kubernetes PKI Directory And File Ownership Should Be

More Info:

Verifies that the Kubernetes PKI directory and its files are owned by root:root so only privileged users can access the cluster certificates and keys.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS Kubernetes

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every control plane node, review current ownership of the PKI directory and its contents:

   sudo find /etc/kubernetes/pki/ -xdev -exec stat -c '%n %U:%G' {} \;

2. If any entry is not owned by root:root, correct the ownership of the entire PKI tree:

   sudo chown -R root:root /etc/kubernetes/pki/

3. Re-check for any remaining non-root:root ownership (should return no output):

   sudo find /etc/kubernetes/pki/ -xdev ! -user root -o ! -group root

4. Verify compliance using the audit-style command:

   sudo find /etc/kubernetes/pki/ | xargs stat -c %U:%G | sort -u

   Ensure the output contains only:

   root:root

Using kubectl

kubectl cannot change file ownership or permissions on the node filesystem, including /etc/kubernetes/pki/. This finding must be remediated directly on every control plane node via host-level commands; see the Manual Steps section for how to fix and verify the ownership.

Automation

#!/usr/bin/env bash
#
# Purpose: Ensure Kubernetes PKI directory and file ownership is root:root
# Scope:   Run on every control plane node
# Usage:   sudo bash fix-k8s-pki-ownership.sh

set -euo pipefail

PKI_DIR="/etc/kubernetes/pki"

echo "=== Kubernetes PKI ownership remediation ==="
echo "Target directory: ${PKI_DIR}"
echo

# 1) Pre-checks
if [[ "$(id -u)" -ne 0 ]]; then
  echo "ERROR: This script must be run as root." >&2
  exit 1
fi

if [[ ! -d "${PKI_DIR}" ]]; then
  echo "No PKI directory found at ${PKI_DIR}. Nothing to do on this node."
  exit 0
fi

# 2) Show current ownership for visibility
echo "Current ownership (before fix):"
find "${PKI_DIR}/" -print0 | xargs -0 stat -c '%n %U:%G' | sort
echo

# 3) Apply remediation (idempotent)
echo "Applying chown -R root:root ${PKI_DIR}/ ..."
chown -R root:root "${PKI_DIR}/"
echo "Ownership change complete."
echo

# 4) Verification (authoritative audit)
echo "Verifying ownership (expected: root:root for all paths)..."
VERIFY_OUTPUT="$(find "${PKI_DIR}/" -print0 | xargs -0 stat -c '%U:%G' | sort -u)"

echo "${VERIFY_OUTPUT}"
echo

if [[ "${VERIFY_OUTPUT}" == "root:root" ]]; then
  echo "SUCCESS: All files and directories under ${PKI_DIR}/ are owned by root:root."
  exit 0
else
  echo "WARNING: Some entries under ${PKI_DIR}/ are not owned by root:root." >&2
  echo "Please review the above lines and adjust manually if required."
  exit 1
fi