Kubelet Kubeconfig File Permissions Set To 644 Or More Restrictive

More Info:

The kubelet kubeconfig file should have permissions of 644 or more restrictive to prevent unauthorized modification of node authentication configuration.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS AKS

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every worker node, check if the kubelet kubeconfig exists at the affected path and view its current permissions:

   sudo stat -c 'path=%n permissions=%a owner=%U group=%G' /var/lib/kubelet/kubeconfig
   

2. If the file exists, set its permissions to 644 (owner read/write, group read, others read):

   sudo chmod 644 /var/lib/kubelet/kubeconfig
   

3. (Optional but recommended) Ensure the file is owned by root:

   sudo chown root:root /var/lib/kubelet/kubeconfig
   

4. Verify the new permissions on every worker node:

   sudo stat -c 'path=%n permissions=%a owner=%U group=%G' /var/lib/kubelet/kubeconfig
   

   Confirm that permissions=644 (or more restrictive, e.g. 640 or 600).

Using kubectl

kubectl cannot change file permissions on node-local paths such as /var/lib/kubelet/kubeconfig; this must be fixed directly on every worker node’s filesystem (host-level configuration). Please see the Manual Steps section for the exact commands to run on each node and how to verify the fix.

Automation

#!/usr/bin/env bash
#
# Hardens kubelet kubeconfig file permissions to 0644 on every worker node.
# Usage:
#   1) Create a file "workers.txt" with one worker node hostname/IP per line.
#   2) Run: bash fix-kubelet-kubeconfig-perms.sh workers.txt
#
# Requirements:
#   - SSH access to each worker node
#   - Sudo rights on each worker node

set -euo pipefail

if [ "$#" -ne 1 ]; then
  echo "Usage: $0 workers.txt" >&2
  exit 1
fi

WORKERS_FILE="$0"
WORKERS_FILE="$1"

if [ ! -f "$WORKERS_FILE" ]; then
  echo "Workers file not found: $WORKERS_FILE" >&2
  exit 1
fi

REMOTE_SCRIPT='
set -euo pipefail

TARGET_FILE="/var/lib/kubelet/kubeconfig"

if [ ! -e "$TARGET_FILE" ]; then
  echo "SKIP: $TARGET_FILE does not exist on this node."
  exit 0
fi

CURRENT_PERMS=$(stat -c "%a" "$TARGET_FILE")

# Only change if permissions are more permissive than 644
# i.e., numeric value > 644
if [ "$CURRENT_PERMS" -gt 644 ]; then
  echo "INFO: $TARGET_FILE has permissions $CURRENT_PERMS, tightening to 644"
  sudo chmod 644 "$TARGET_FILE"
else
  echo "OK: $TARGET_FILE already has permissions $CURRENT_PERMS (<= 644), no change needed"
fi

# Verification
NEW_PERMS=$(stat -c "permissions=%a" "$TARGET_FILE")
echo "VERIFY: $TARGET_FILE -> $NEW_PERMS"
'

while IFS= read -r NODE; do
  # Skip empty lines and comments
  if [ -z "$NODE" ] || [[ "$NODE" =~ ^# ]]; then
    continue
  fi

  echo "===== Processing worker node: $NODE ====="
  ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "$NODE" "$REMOTE_SCRIPT"
  echo
done < "$WORKERS_FILE"