Skip to main content

Scheduler Kubeconfig File Permissions Should Be 600 Or More

More Info:​

Verifies that the scheduler.conf kubeconfig file has permissions of 600 or more restrictive to protect the schedulers client credentials.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current permissions of the scheduler kubeconfig file:

    stat -c permissions=%a /etc/kubernetes/scheduler.conf

  2. On every control plane node, set the permissions of the scheduler kubeconfig file to 600:

    sudo chmod 600 /etc/kubernetes/scheduler.conf

  3. On every control plane node, verify that the permissions are now 600:

    stat -c permissions=%a /etc/kubernetes/scheduler.conf
Using kubectl

kubectl cannot modify file permissions on control plane nodes, including /etc/kubernetes/scheduler.conf. This fix must be applied directly on every control plane node at the host OS level; see the Manual Steps section for the exact commands to run there.

Automation
#!/usr/bin/env bash
#
# Automation: Fix scheduler.conf file permissions (CIS Kubernetes 1.1.15)
# Target: every control plane node
#
# Usage:
#   1) Copy this script to each control plane node.
#   2) Run as root:  bash fix_scheduler_kubeconfig_perms.sh
#

set -euo pipefail

SCHEDULER_CONF="/etc/kubernetes/scheduler.conf"
DESIRED_PERMS="600"

echo "=== Checking for ${SCHEDULER_CONF} ==="

if [ ! -e "${SCHEDULER_CONF}" ]; then
  echo "File not found: ${SCHEDULER_CONF}"
  echo "Nothing to change on this node."
else
  # Show current permissions
  CURRENT_PERMS="$(stat -c '%a' "${SCHEDULER_CONF}")"
  echo "Current permissions: ${CURRENT_PERMS}"

  # Apply fix only if needed
  if [ "${CURRENT_PERMS}" != "${DESIRED_PERMS}" ]; then
    echo "Setting permissions to ${DESIRED_PERMS} on ${SCHEDULER_CONF}"
    chmod "${DESIRED_PERMS}" "${SCHEDULER_CONF}"
  else
    echo "Permissions already set to ${DESIRED_PERMS}; no change needed."
  fi

  # Verification (same logic as audit command)
  echo "=== Verifying permissions ==="
  stat -c 'permissions=%a  file=%n' "${SCHEDULER_CONF}"
fi

echo "=== Completed scheduler.conf permissions check ==="