Detections
Analytics

3.1.2 Ensure that the kubelet kubeconfig file ownership is set to root:root

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

If kubelet is running, ensure that the file ownership of its kubeconfig file is set to root:root.

The kubeconfig file for kubelet controls various parameters for the kubelet service in the worker node. You should set its file ownership to maintain the integrity of the file. The file should be owned by root:root.

Solution

Run the below command (based on the file location on your system) on each worker node.

For example,

chown root:root <proxy kubeconfig file>

Impact:

Overly permissive file access increases the security risk to the platform.

See Also

https://workbench.cisecurity.org/benchmarks/24112

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|5.2

Plugin: Unix

Control ID: b1e1f919a6b3bebe80a4c9d179ae30e0c7b9c04ad8d3a44f9bc073dc51561641