Skip to main content

Scheduler Pod Specification File Permissions Should Be 600

More Info:​

Verifies that the kube-scheduler pod manifest file has permissions of 600 or more restrictive to prevent unauthorized tampering.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current permissions of the scheduler manifest file:

    stat -c permissions=%a /etc/kubernetes/manifests/kube-scheduler.yaml

  2. On every control plane node, set the permissions to 600 as required:

    chmod 600 /etc/kubernetes/manifests/kube-scheduler.yaml

  3. (Optional, on every control plane node) Confirm file ownership is appropriate (typically root:root):

    stat -c 'owner=%U group=%G' /etc/kubernetes/manifests/kube-scheduler.yaml

  4. On every control plane node, verify the permissions now meet the benchmark (600 or more restrictive, e.g., 600, 640 not allowed, 400 allowed):

    stat -c permissions=%a /etc/kubernetes/manifests/kube-scheduler.yaml
Using kubectl

kubectl cannot modify file permissions on control plane nodes, so it cannot be used to fix /etc/kubernetes/manifests/kube-scheduler.yaml. This must be corrected directly on each control plane node’s filesystem; follow the guidance in the Manual Steps section.

Automation
#!/usr/bin/env bash
# Purpose: Ensure kube-scheduler pod manifest file permissions are 600
# Scope:   Run on every control plane node
# Usage:   sudo /root/fix-kube-scheduler-perms.sh

set -euo pipefail

SCHEDULER_MANIFEST="/etc/kubernetes/manifests/kube-scheduler.yaml"
DESIRED_MODE="600"

echo "==> Checking for kube-scheduler manifest at ${SCHEDULER_MANIFEST}"

if [ ! -e "${SCHEDULER_MANIFEST}" ]; then
  echo "File not found: ${SCHEDULER_MANIFEST}"
  echo "Nothing to change on this node."
  exit 0
fi

# Get current mode (numeric)
CURRENT_MODE="$(stat -c '%a' "${SCHEDULER_MANIFEST}")"

echo "Current permissions: ${CURRENT_MODE}"
echo "Desired permissions: ${DESIRED_MODE}"

if [ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]; then
  echo "Updating permissions to ${DESIRED_MODE} ..."
  chmod "${DESIRED_MODE}" "${SCHEDULER_MANIFEST}"
else
  echo "Permissions already set to ${DESIRED_MODE}; no change needed."
fi

echo "==> Verifying permissions after change"
VERIFY_OUT="$(stat -c 'permissions=%a' "${SCHEDULER_MANIFEST}")"
echo "${VERIFY_OUT}"

if [ "${VERIFY_OUT}" != "permissions=${DESIRED_MODE}" ]; then
  echo "ERROR: Verification failed; expected permissions=${DESIRED_MODE}" >&2
  exit 1
fi

echo "==> Success: kube-scheduler manifest permissions are ${DESIRED_MODE}"
echo "Note: Editing files in /etc/kubernetes/manifests causes the kube-scheduler static pod to be restarted by the kubelet if contents change. A chmod alone should not restart it."