Skip to main content

Proxy Kubeconfig File Ownership Set To root:root

More Info:​

If the kube-proxy kubeconfig file exists it should be owned by root:root so only privileged users can read or modify it. Incorrect ownership risks exposure of connection settings.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check if the proxy kubeconfig file exists and view its current ownership:

    ls -l /etc/kubernetes/proxy.conf

  2. If the file exists and is not owned by root:root, change its ownership on that worker node:

    sudo chown root:root /etc/kubernetes/proxy.conf

  3. Confirm the permissions are appropriate (readable only by root or as per your policy) and adjust if needed, for example:

    sudo chmod 600 /etc/kubernetes/proxy.conf

  4. Repeat steps 1–3 on every worker node in the cluster where /etc/kubernetes/proxy.conf is present.

  5. Verify on each worker node that the ownership is now correctly set to root:root:

    /bin/sh -c 'if test -e /etc/kubernetes/proxy.conf; then stat -c %U:%G /etc/kubernetes/proxy.conf; fi'
Using kubectl

This setting is controlled by file ownership on each worker node’s filesystem and cannot be changed through the Kubernetes API, so kubectl cannot remediate it. To fix the issue, adjust the ownership of /etc/kubernetes/proxy.conf directly on every worker node as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
# Purpose: Ensure kube-proxy kubeconfig (/etc/kubernetes/proxy.conf) is owned by root:root
# Scope:   Run on every worker node
# Usage:   sudo /usr/local/sbin/fix-kube-proxy-kubeconfig-ownership.sh

set -euo pipefail

TARGET_FILE="/etc/kubernetes/proxy.conf"

echo "==> Checking for ${TARGET_FILE}"

if [ ! -e "${TARGET_FILE}" ]; then
  echo "    File not found; nothing to do on this node."
  exit 0
fi

CURRENT_OWNER_GROUP="$(stat -c '%U:%G' "${TARGET_FILE}")"

if [ "${CURRENT_OWNER_GROUP}" = "root:root" ]; then
  echo "    Ownership already correct (root:root); no change needed."
else
  echo "    Current ownership is ${CURRENT_OWNER_GROUP}; updating to root:root"
  chown root:root "${TARGET_FILE}"
fi

echo "==> Verifying ownership"
VERIFY_OWNER_GROUP="$(stat -c '%U:%G' "${TARGET_FILE}")"

if [ "${VERIFY_OWNER_GROUP}" != "root:root" ]; then
  echo "ERROR: Failed to set ownership to root:root (current: ${VERIFY_OWNER_GROUP})" >&2
  exit 1
fi

echo "    Verified: ${TARGET_FILE} is owned by root:root"
exit 0