Kubelet Kubeconfig File Permissions Set To 644 Or More

More Info:

The kubelet kubeconfig file should have permissions of 644 or more restrictive. Loose permissions could allow unauthorized users to read or alter the kubelets cluster credentials.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS OKE

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every worker node, check the current permissions of the kubelet kubeconfig file:

   stat -c permissions=%a /var/lib/kubelet/kubeconfig

2. If the file exists and permissions are more permissive than 644 (e.g., 664, 666, 777), set them to 644:

   chmod 644 /var/lib/kubelet/kubeconfig

3. Ensure the file is owned by the kubelet user and group (commonly root:root; adjust if your environment differs):

   chown root:root /var/lib/kubelet/kubeconfig

4. Repeat steps 1–3 on each worker node in the cluster.

5. Verification (on every worker node):

   stat -c permissions=%a /var/lib/kubelet/kubeconfig

   Confirm the output shows:

   permissions=644

Using kubectl

This file’s permissions are set on each worker node’s filesystem and cannot be changed via kubectl or any Kubernetes API object. To remediate, adjust the file mode directly on the node (host-level fix); see the Manual Steps section for the exact commands to run on every worker node.

Automation

#!/usr/bin/env bash
#
# Fix CIS OKE 3.1.1: Ensure kubelet kubeconfig file permissions are 644 or more restrictive
# Target: every worker node
#
# Run this script on each worker node (e.g., via SSH, Ansible shell, or your CM tool).
# It is safe to re-run.

set -euo pipefail

KUBELET_KUBECONFIG="/var/lib/kubelet/kubeconfig"   # Affected resource from finding
LEGACY_PATH="/etc/kubernetes/kubelet.conf"         # Path used by audit example/remediation
DESIRED_MODE="644"

change_mode_if_exists() {
  local path="$1"
  if [ -e "${path}" ]; then
    current_mode="$(stat -c '%a' "${path}")" || current_mode="UNKNOWN"
    echo "Found kubelet kubeconfig at: ${path} (current mode: ${current_mode})"

    if [ "${current_mode}" != "${DESIRED_MODE}" ]; then
      echo "Setting permissions to ${DESIRED_MODE} on ${path}"
      chmod "${DESIRED_MODE}" "${path}"
    else
      echo "Permissions already ${DESIRED_MODE} on ${path}; no change needed"
    fi
  else
    echo "Path not present, skipping: ${path}"
  fi
}

echo "=== Adjusting kubelet kubeconfig permissions on this node ==="

# Handle both the finding's path and the benchmark's example path
change_mode_if_exists "${KUBELET_KUBECONFIG}"
change_mode_if_exists "${LEGACY_PATH}"

echo
echo "=== Verification ==="

if [ -e "${KUBELET_KUBECONFIG}" ]; then
  echo "Verifying ${KUBELET_KUBECONFIG}:"
  stat -c 'permissions=%a %n' "${KUBELET_KUBECONFIG}"
fi

if [ -e "${LEGACY_PATH}" ]; then
  echo "Verifying ${LEGACY_PATH}:"
  stat -c 'permissions=%a %n' "${LEGACY_PATH}"
fi

echo
echo "Expected: permissions=644 for any kubelet kubeconfig file present on this worker node."