Skip to main content

Kubelet Configuration File Has Permissions Set Restrictive

More Info:​

Ensure that the kubelet configuration file has permissions of 644 or more restrictive.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS OKE
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check the current permissions of the kubelet configuration file:

    stat -c permissions=%a /var/lib/kubelet/config.yaml

  2. On every worker node, set the permissions to 644 (owner read/write, group read, others read):

    chmod 644 /var/lib/kubelet/config.yaml

  3. (If your environment expects the legacy path as well) If /etc/kubernetes/kubelet-config.json exists, align its permissions too:

    if [ -e /etc/kubernetes/kubelet-config.json ]; then
      chmod 644 /etc/kubernetes/kubelet-config.json
    fi

  4. On every worker node, verify the final permissions for the active kubelet config file:

    stat -c permissions=%a /var/lib/kubelet/config.yaml

  5. (Optional) If you use /etc/kubernetes/kubelet-config.json for tooling or compatibility, verify its permissions as per the benchmark’s audit:

    if test -e /etc/kubernetes/kubelet-config.json; then
      stat -c permissions=%a /etc/kubernetes/kubelet-config.json
    fi
Using kubectl

kubectl cannot modify file permissions on node-local kubelet configuration files such as /var/lib/kubelet/config.yaml; this must be fixed directly on every worker node via host-level access (for example, SSH). See the Manual Steps section for the exact commands to run on each node.

Automation
#!/usr/bin/env bash
#
# Harden kubelet configuration file permissions on every worker node.
# Target file: /var/lib/kubelet/config.yaml
#
# Usage:
#   1) Copy this script to each worker node (e.g. /root/fix-kubelet-perms.sh)
#   2) Run as root on every worker node:
#        bash /root/fix-kubelet-perms.sh
#   3) Safe to re-run; it is idempotent.

set -euo pipefail

KUBELET_CFG="/var/lib/kubelet/config.yaml"
DESIRED_MODE="644"

echo "=== Kubelet config permission hardening ==="
echo "Target file: ${KUBELET_CFG}"
echo

if [ ! -e "${KUBELET_CFG}" ]; then
  echo "WARNING: ${KUBELET_CFG} does not exist on this node. Nothing to do."
  exit 0
fi

# Show current permissions
current_mode="$(stat -c '%a' "${KUBELET_CFG}")" || {
  echo "ERROR: Failed to read current permissions for ${KUBELET_CFG}"
  exit 1
}

echo "Current permissions: ${current_mode}"

# Apply fix only if needed
if [ "${current_mode}" != "${DESIRED_MODE}" ]; then
  echo "Setting permissions to ${DESIRED_MODE} on ${KUBELET_CFG} ..."
  chmod "${DESIRED_MODE}" "${KUBELET_CFG}"
else
  echo "Permissions already set to ${DESIRED_MODE}; no change needed."
fi

# Verification (mirrors benchmark audit intent)
echo
echo "=== Verifying permissions ==="
verified_mode="$(stat -c 'permissions=%a' "${KUBELET_CFG}")" || {
  echo "ERROR: Verification failed; could not stat ${KUBELET_CFG}"
  exit 1
}
echo "Verification result: ${verified_mode}"

# Parse out numeric mode for comparison
verified_numeric="${verified_mode#permissions=}"

if [ "${verified_numeric}" = "${DESIRED_MODE}" ]; then
  echo "SUCCESS: ${KUBELET_CFG} is now set to ${DESIRED_MODE} as required."
  exit 0
else
  echo "ERROR: Expected permissions ${DESIRED_MODE} but found ${verified_numeric}"
  exit 2
fi

Additional Reading:​