Skip to main content

Kubelet Configuration File Ownership Set To root:root

More Info:​

The kubelet configuration file should be owned by root:root. Incorrect ownership could allow non-root users to alter the kubelet configuration.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS OKE

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, confirm whether the kubelet configuration file exists and check its current ownership:

    ls -l /etc/kubernetes/kubelet-config.json || echo "File not found"

  2. If the file exists and is not owned by root:root, change the ownership to root:root:

    sudo chown root:root /etc/kubernetes/kubelet-config.json

  3. (Optional, if you suspect permissions are too loose) Restrict file permissions to owner read/write only:

    sudo chmod 600 /etc/kubernetes/kubelet-config.json

  4. Repeat steps 1–3 on every worker node in the cluster.

  5. On every worker node, verify the ownership is now correct:

    /bin/sh -c 'if test -e /etc/kubernetes/kubelet-config.json; then stat -c %U:%G /etc/kubernetes/kubelet-config.json; else echo "File not found"; fi'

    The output must be:

    root:root
Using kubectl

kubectl cannot change file ownership on node filesystems, including /etc/kubernetes/kubelet-config.json. This finding must be remediated directly on every worker node’s host OS; see the Manual Steps section for the exact commands to run over SSH.

Automation
#!/usr/bin/env bash
#
# Remediate CIS OKE 3.1.4:
# Ensure kubelet configuration file ownership is set to root:root
#
# Run on: every worker node (as root)
# Safe to re-run: yes

set -euo pipefail

KUBELET_CONFIG_PATH="/etc/kubernetes/kubelet-config.json"

echo "==> Checking for kubelet config file at: ${KUBELET_CONFIG_PATH}"

if [ ! -e "${KUBELET_CONFIG_PATH}" ]; then
  echo "Kubelet config file not found at ${KUBELET_CONFIG_PATH}."
  echo "Nothing to change on this node."
  exit 0
fi

current_owner_group="$(stat -c '%U:%G' "${KUBELET_CONFIG_PATH}")"
echo "Current ownership: ${current_owner_group}"

if [ "${current_owner_group}" = "root:root" ]; then
  echo "Ownership already set to root:root; no change needed."
else
  echo "Setting ownership to root:root ..."
  chown root:root "${KUBELET_CONFIG_PATH}"
fi

echo "==> Verifying ownership (CIS OKE 3.1.4)..."
stat -c '%n %U:%G' "${KUBELET_CONFIG_PATH}"