Detections
Analytics

4.1.11 Ensure that the kubelet drop-in configuration directory and files have restrictive permissions

Information

If the kubelet is configured with a drop-in configuration directory ( --config-dir ), ensure the directory and all .conf files within it have ownership set to root:root with permissions 755 for the directory and 644 for the files.

The kubelet drop-in configuration directory (typically /etc/kubernetes/kubelet.conf.d ) allows partial configuration files to override any field in the kubelet configuration, including security-critical settings such as authentication.anonymous.enabled, authorization.mode, authentication.x509.clientCAFile, featureGates, and readOnlyPort . A process or user that can write to this directory can reconfigure the kubelet to disable authentication, weaken authorization, or enable dangerous features. The kubelet processes drop-in files in alphanumeric order on startup, and a later file overrides earlier settings.

Solution

# Set directory permissions
chown root:root /etc/kubernetes/kubelet.conf.d
chmod 755 /etc/kubernetes/kubelet.conf.d

# Set file permissions
chown root:root /etc/kubernetes/kubelet.conf.d/*.conf
chmod 644 /etc/kubernetes/kubelet.conf.d/*.conf

Impact:

Restricting permissions on the drop-in directory may require updating deployment tooling (e.g., Ansible, Puppet, kubeadm hooks) that writes kubelet configuration snippets. Processes that currently create or modify drop-in files will need to run as root.

See Also

https://workbench.cisecurity.org/benchmarks/26886

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: d4a6f50b51c2d833935fd45f5ec774f3a5958cc800c0c17344683b739a372b97