Ensure Kubelet Kubeconfig File Ownership Is Set Root

Manual Steps

On every worker node, check the current ownership of the kubelet kubeconfig file:
stat -c %U:%G /etc/kubernetes/kubelet.conf
If the file exists and the ownership is not root:root, change the ownership on that worker node:
chown root:root /etc/kubernetes/kubelet.conf
(Optional) Confirm filesystem permissions did not change unexpectedly:
stat -c %a /etc/kubernetes/kubelet.conf

Verify the fix on that worker node using the audit-style command:

/bin/sh -c 'if test -e /etc/kubernetes/kubelet.conf; then stat -c %U:%G /etc/kubernetes/kubelet.conf; else echo "File not found"; fi'

Using kubectl

kubectl cannot modify file ownership on worker node filesystems, including /etc/kubernetes/kubelet.conf, so this finding cannot be fixed through the Kubernetes API. The required change must be made directly on each worker node’s host OS; see the Manual Steps section for the exact commands to run there.

Automation

#!/usr/bin/env bash
#
# Fix: Ensure kubelet kubeconfig file ownership is set to root:root
# Scope: Run on every worker node (as root or with sudo)
# Safe to re-run: yes

set -euo pipefail

KUBELET_KUBECONFIG="/etc/kubernetes/kubelet.conf"

echo "==> Checking for kubelet kubeconfig at ${KUBELET_KUBECONFIG}"

if [ ! -e "${KUBELET_KUBECONFIG}" ]; then
  echo "File not found: ${KUBELET_KUBECONFIG}"
  echo "Nothing to change on this node."
  exit 0
fi

echo "==> Current ownership:"
stat -c '%n %U:%G' "${KUBELET_KUBECONFIG}"

# Apply remediation (idempotent)
echo "==> Setting ownership to root:root..."
chown root:root "${KUBELET_KUBECONFIG}"

# Verification
echo "==> Verifying ownership after change:"
OWNER_GROUP="$(stat -c '%U:%G' "${KUBELET_KUBECONFIG}")"
echo "${KUBELET_KUBECONFIG} ${OWNER_GROUP}"

if [ "${OWNER_GROUP}" != "root:root" ]; then
  echo "ERROR: Ownership is not root:root after chown. Investigate permissions on this node." >&2
  exit 1
fi

echo "==> Ownership successfully set to root:root on ${KUBELET_KUBECONFIG}"

Usage (on every worker node):

sudo bash ./fix-kubelet-kubeconfig-ownership.sh

This script:

Ensures /etc/kubernetes/kubelet.conf exists.
Runs chown root:root /etc/kubernetes/kubelet.conf.
Re-runs the audit (stat -c %U:%G /etc/kubernetes/kubelet.conf) and fails if the result is not root:root.

OCI Misconfigurations

Ensure Kubelet Kubeconfig File Ownership Is Set Root

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading: