Skip to main content

Ensure Kubelet Kubeconfig File Ownership Is Set Root

More Info:​

Ensure that the kubelet kubeconfig file ownership is set to root:root.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS OKE
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check the current ownership of the kubelet kubeconfig file:

    stat -c %U:%G /etc/kubernetes/kubelet.conf

  2. If the file exists and the ownership is not root:root, change the ownership on that worker node:

    chown root:root /etc/kubernetes/kubelet.conf

  3. (Optional) Confirm filesystem permissions did not change unexpectedly:

    stat -c %a /etc/kubernetes/kubelet.conf

  4. Verify the fix on that worker node using the audit-style command:

    /bin/sh -c 'if test -e /etc/kubernetes/kubelet.conf; then stat -c %U:%G /etc/kubernetes/kubelet.conf; else echo "File not found"; fi'
Using kubectl

kubectl cannot modify file ownership on worker node filesystems, including /etc/kubernetes/kubelet.conf, so this finding cannot be fixed through the Kubernetes API. The required change must be made directly on each worker node’s host OS; see the Manual Steps section for the exact commands to run there.

Automation
#!/usr/bin/env bash
#
# Fix: Ensure kubelet kubeconfig file ownership is set to root:root
# Scope: Run on every worker node (as root or with sudo)
# Safe to re-run: yes

set -euo pipefail

KUBELET_KUBECONFIG="/etc/kubernetes/kubelet.conf"

echo "==> Checking for kubelet kubeconfig at ${KUBELET_KUBECONFIG}"

if [ ! -e "${KUBELET_KUBECONFIG}" ]; then
  echo "File not found: ${KUBELET_KUBECONFIG}"
  echo "Nothing to change on this node."
  exit 0
fi

echo "==> Current ownership:"
stat -c '%n %U:%G' "${KUBELET_KUBECONFIG}"

# Apply remediation (idempotent)
echo "==> Setting ownership to root:root..."
chown root:root "${KUBELET_KUBECONFIG}"

# Verification
echo "==> Verifying ownership after change:"
OWNER_GROUP="$(stat -c '%U:%G' "${KUBELET_KUBECONFIG}")"
echo "${KUBELET_KUBECONFIG} ${OWNER_GROUP}"

if [ "${OWNER_GROUP}" != "root:root" ]; then
  echo "ERROR: Ownership is not root:root after chown. Investigate permissions on this node." >&2
  exit 1
fi

echo "==> Ownership successfully set to root:root on ${KUBELET_KUBECONFIG}"

Usage (on every worker node):

sudo bash ./fix-kubelet-kubeconfig-ownership.sh

This script:

  • Ensures /etc/kubernetes/kubelet.conf exists.
  • Runs chown root:root /etc/kubernetes/kubelet.conf.
  • Re-runs the audit (stat -c %U:%G /etc/kubernetes/kubelet.conf) and fails if the result is not root:root.

Additional Reading:​