Skip to main content

Proxy Kubeconfig File Permissions Set To 600 Or More

More Info:​

If the kube-proxy kubeconfig file exists it may contain connection credentials and should be protected. Permissions of 600 or more restrictive keep it readable only by root.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On each worker node, check if the kube-proxy kubeconfig file exists and view its current permissions:

    ls -l /etc/kubernetes/proxy.conf 2>/dev/null || echo "proxy.conf not present on this node"

  2. On each worker node where /etc/kubernetes/proxy.conf exists, set its permissions to 600:

    chmod 600 /etc/kubernetes/proxy.conf

  3. On each worker node, confirm the file is owned by root and in the root group (adjust if necessary):

    chown root:root /etc/kubernetes/proxy.conf

  4. On each worker node, verify the final permissions match the benchmark requirement:

    stat -c permissions=%a /etc/kubernetes/proxy.conf

    The output must show:

    permissions=600
Using kubectl

kubectl cannot modify file permissions on worker node files such as /etc/kubernetes/proxy.conf; this must be fixed directly on each worker node’s host filesystem. Use SSH and follow the steps in the Manual Steps section to set the correct permissions.

Automation
#!/usr/bin/env bash
#
# Fix: Ensure /etc/kubernetes/proxy.conf has permissions 600 or more restrictive
# Scope: Run on every worker node (as root). Safe to re-run.

set -euo pipefail

PROXY_CONF="/etc/kubernetes/proxy.conf"

echo "==> Checking for ${PROXY_CONF}"

if [ ! -e "${PROXY_CONF}" ]; then
  echo "File ${PROXY_CONF} does not exist on this node. Nothing to do."
  exit 0
fi

# Show current permissions
current_perm="$(stat -c '%a' "${PROXY_CONF}")"
echo "Current permissions: ${current_perm}"

# Apply restrictive permissions (idempotent)
echo "Setting permissions to 600 on ${PROXY_CONF}"
chmod 600 "${PROXY_CONF}"

# Verify
echo "Verifying final permissions..."
final_perm="$(stat -c '%a' "${PROXY_CONF}")"
echo "Final permissions: ${final_perm}"

if [ "${final_perm}" -le 600 ]; then
  echo "SUCCESS: ${PROXY_CONF} permissions are ${final_perm}, which is 600 or more restrictive."
  # Re-run of the benchmark audit equivalent
  echo "Audit output:"
  /bin/sh -c "if test -e ${PROXY_CONF}; then stat -c permissions=%a ${PROXY_CONF}; fi"
  exit 0
else
  echo "ERROR: ${PROXY_CONF} permissions are ${final_perm}, which is NOT 600 or more restrictive."
  exit 1
fi