Skip to main content

Kubelet Configuration File Permissions Set To 644 Or More

More Info:​

The kubelet configuration file should have permissions of 644 or more restrictive. Overly permissive permissions could allow unauthorized modification of the kubelet configuration.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS OKE

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, check the current permissions of the kubelet configuration file:

    stat -c permissions=%a /etc/kubernetes/kubelet-config.json

  2. On every worker node, set the permissions to 644 as required:

    chmod 644 /etc/kubernetes/kubelet-config.json

  3. (If desired) Confirm ownership is appropriate (typically root:root); adjust if needed:

    stat -c '%U:%G' /etc/kubernetes/kubelet-config.json
    # If not root:root, then:
    chown root:root /etc/kubernetes/kubelet-config.json

  4. Verify the fix on every worker node using the audit command:

    /bin/sh -c 'if test -e /etc/kubernetes/kubelet-config.json; then stat -c permissions=%a /etc/kubernetes/kubelet-config.json; fi'

    Ensure the output shows permissions=644 (or a more restrictive value such as 640 or 600).

Using kubectl

kubectl cannot modify host-level file permissions such as /etc/kubernetes/kubelet-config.json on worker nodes. To remediate this finding, you must change the file mode directly on every worker node’s filesystem; see the Manual Steps section for the exact commands.

Automation
#!/usr/bin/env bash
#
# Remediates CIS OKE 3.1.3 on every worker node:
# Ensures /etc/kubernetes/kubelet-config.json permissions are 644.
#
# Usage:
#   1) Ensure you can SSH to each worker (e.g. via SSH keys).
#   2) Create a file "workers.txt" with one worker hostname/IP per line.
#   3) Run: bash fix-kubelet-config-perms.sh workers.txt
#
# This script is idempotent and safe to re-run.

set -euo pipefail

WORKER_LIST_FILE="${1:-}"

if [[ -z "$WORKER_LIST_FILE" || ! -f "$WORKER_LIST_FILE" ]]; then
  echo "Usage: $0 /path/to/workers.txt" >&2
  exit 1
fi

# Remote remediation script to run on each worker node
read -r -d '' REMOTE_SCRIPT << 'EOF'
set -euo pipefail

CONFIG_FILE="/etc/kubernetes/kubelet-config.json"

if [[ ! -e "$CONFIG_FILE" ]]; then
  echo "SKIP: $CONFIG_FILE does not exist on this node."
  exit 0
fi

# Show current permissions
CURRENT_PERMS="$(stat -c '%a' "$CONFIG_FILE")"
echo "Current permissions for $CONFIG_FILE: $CURRENT_PERMS"

# Apply remediation (idempotent)
chmod 644 "$CONFIG_FILE"

# Verify
NEW_PERMS="$(stat -c 'permissions=%a' "$CONFIG_FILE")"
echo "Post-fix: $NEW_PERMS"

if [[ "$NEW_PERMS" != "permissions=644" ]]; then
  echo "ERROR: Failed to set permissions to 644 on $CONFIG_FILE" >&2
  exit 1
fi

echo "OK: $CONFIG_FILE permissions set to 644"
EOF

while IFS= read -r NODE; do
  [[ -z "$NODE" || "$NODE" =~ ^# ]] && continue

  echo "==== Remediating node: $NODE ===="
  ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "$NODE" "bash -s" <<< "$REMOTE_SCRIPT" || {
    echo "ERROR: Remediation failed on node $NODE" >&2
  }
  echo
done < "$WORKER_LIST_FILE"