Kubelet Configuration File Ownership Set To root:root

Manual Steps

On every worker node, confirm whether the kubelet configuration file exists and check its current ownership:
ls -l /etc/kubernetes/kubelet-config.json || echo "File not found"
If the file exists and is not owned by root:root, change the ownership to root:root:
sudo chown root:root /etc/kubernetes/kubelet-config.json
(Optional, if you suspect permissions are too loose) Restrict file permissions to owner read/write only:
sudo chmod 600 /etc/kubernetes/kubelet-config.json
Repeat steps 1–3 on every worker node in the cluster.

On every worker node, verify the ownership is now correct:

/bin/sh -c 'if test -e /etc/kubernetes/kubelet-config.json; then stat -c %U:%G /etc/kubernetes/kubelet-config.json; else echo "File not found"; fi'

The output must be:

root:root

Using kubectl

kubectl cannot change file ownership on node filesystems, including /etc/kubernetes/kubelet-config.json. This finding must be remediated directly on every worker node’s host OS; see the Manual Steps section for the exact commands to run over SSH.

Automation

#!/usr/bin/env bash
#
# Remediate CIS OKE 3.1.4:
# Ensure kubelet configuration file ownership is set to root:root
#
# Run on: every worker node (as root)
# Safe to re-run: yes

set -euo pipefail

KUBELET_CONFIG_PATH="/etc/kubernetes/kubelet-config.json"

echo "==> Checking for kubelet config file at: ${KUBELET_CONFIG_PATH}"

if [ ! -e "${KUBELET_CONFIG_PATH}" ]; then
  echo "Kubelet config file not found at ${KUBELET_CONFIG_PATH}."
  echo "Nothing to change on this node."
  exit 0
fi

current_owner_group="$(stat -c '%U:%G' "${KUBELET_CONFIG_PATH}")"
echo "Current ownership: ${current_owner_group}"

if [ "${current_owner_group}" = "root:root" ]; then
  echo "Ownership already set to root:root; no change needed."
else
  echo "Setting ownership to root:root ..."
  chown root:root "${KUBELET_CONFIG_PATH}"
fi

echo "==> Verifying ownership (CIS OKE 3.1.4)..."
stat -c '%n %U:%G' "${KUBELET_CONFIG_PATH}"

OCI Misconfigurations

Kubelet Configuration File Ownership Set To root:root

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation