Skip to main content

Ensure Kubelet Configuration File Ownership Is Set Root

More Info:​

Ensure that the kubelet configuration file ownership is set to root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS OKE
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, confirm the actual kubelet configuration file path and its current ownership:

    ls -l /var/lib/kubelet/config.yaml

  2. If the file exists and is not owned by root:root, change its ownership to root:root:

    sudo chown root:root /var/lib/kubelet/config.yaml

  3. (Optional but recommended) Ensure file permissions are not overly permissive (example: 600):

    sudo chmod 600 /var/lib/kubelet/config.yaml

  4. Repeat steps 1–3 on each worker node in the cluster.

  5. Verification on every worker node (adapted from the audit command, using the actual file path):

    if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G /var/lib/kubelet/config.yaml; else echo "File not found"; fi

    The output must be:

    root:root
Using kubectl

kubectl cannot modify host-level file ownership, including /var/lib/kubelet/config.yaml; this must be corrected directly on every worker node via the operating system. Use the guidance in the Manual Steps section to adjust file ownership and then re-run the audit command to verify.

Automation
#!/usr/bin/env bash
#
# Fix CIS OKE 3.1.4:
# Ensure that the kubelet configuration file ownership is set to root:root.
#
# Run this script on every worker node as root.
# It is safe to re-run; it will only adjust ownership if needed.

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"

echo "=== CIS OKE 3.1.4: Kubelet config file ownership to root:root ==="
echo "Target file: ${KUBELET_CONFIG}"
echo

# Check if file exists
if [[ ! -e "${KUBELET_CONFIG}" ]]; then
  echo "File not found: ${KUBELET_CONFIG}"
  echo "No changes made on this node."
  exit 0
fi

# Show current ownership
current_owner_group=$(stat -c '%U:%G' "${KUBELET_CONFIG}")
echo "Current ownership: ${current_owner_group}"

# Change ownership only if needed
if [[ "${current_owner_group}" != "root:root" ]]; then
  echo "Updating ownership to root:root..."
  chown root:root "${KUBELET_CONFIG}"
else
  echo "Ownership already correct; no change needed."
fi

# Verification
echo
echo "Verifying ownership after remediation..."
verified_owner_group=$(stat -c '%U:%G' "${KUBELET_CONFIG}")
echo "Verified ownership: ${verified_owner_group}"

if [[ "${verified_owner_group}" != "root:root" ]]; then
  echo "FAIL: Ownership is not root:root after remediation." >&2
  exit 1
fi

echo "PASS: ${KUBELET_CONFIG} ownership is correctly set to root:root."

Additional Reading:​