> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet Configuration File Permissions Set To 644 Or More Restrictive

### More Info:

The kubelet configuration file should have permissions of 644 or more restrictive. Overly permissive permissions could allow unauthorized modification of the kubelet configuration.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS OKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check the current permissions of the kubelet configuration file:
           ```sh theme={null}
           stat -c permissions=%a /etc/kubernetes/kubelet-config.json
           ```

        2. On every worker node, set the permissions to 644 as required:
           ```sh theme={null}
           chmod 644 /etc/kubernetes/kubelet-config.json
           ```

        3. (If desired) Confirm ownership is appropriate (typically root:root); adjust if needed:
           ```sh theme={null}
           stat -c '%U:%G' /etc/kubernetes/kubelet-config.json
           # If not root:root, then:
           chown root:root /etc/kubernetes/kubelet-config.json
           ```

        4. Verify the fix on every worker node using the audit command:
           ```sh theme={null}
           /bin/sh -c 'if test -e /etc/kubernetes/kubelet-config.json; then stat -c permissions=%a /etc/kubernetes/kubelet-config.json; fi'
           ```
           Ensure the output shows `permissions=644` (or a more restrictive value such as 640 or 600).
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify host-level file permissions such as `/etc/kubernetes/kubelet-config.json` on worker nodes. To remediate this finding, you must change the file mode directly on every worker node’s filesystem; see the Manual Steps section for the exact commands.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediates CIS OKE 3.1.3 on every worker node:
        # Ensures /etc/kubernetes/kubelet-config.json permissions are 644.
        #
        # Usage:
        #   1) Ensure you can SSH to each worker (e.g. via SSH keys).
        #   2) Create a file "workers.txt" with one worker hostname/IP per line.
        #   3) Run: bash fix-kubelet-config-perms.sh workers.txt
        #
        # This script is idempotent and safe to re-run.

        set -euo pipefail

        WORKER_LIST_FILE="${1:-}"

        if [[ -z "$WORKER_LIST_FILE" || ! -f "$WORKER_LIST_FILE" ]]; then
          echo "Usage: $0 /path/to/workers.txt" >&2
          exit 1
        fi

        # Remote remediation script to run on each worker node
        read -r -d '' REMOTE_SCRIPT << 'EOF'
        set -euo pipefail

        CONFIG_FILE="/etc/kubernetes/kubelet-config.json"

        if [[ ! -e "$CONFIG_FILE" ]]; then
          echo "SKIP: $CONFIG_FILE does not exist on this node."
          exit 0
        fi

        # Show current permissions
        CURRENT_PERMS="$(stat -c '%a' "$CONFIG_FILE")"
        echo "Current permissions for $CONFIG_FILE: $CURRENT_PERMS"

        # Apply remediation (idempotent)
        chmod 644 "$CONFIG_FILE"

        # Verify
        NEW_PERMS="$(stat -c 'permissions=%a' "$CONFIG_FILE")"
        echo "Post-fix: $NEW_PERMS"

        if [[ "$NEW_PERMS" != "permissions=644" ]]; then
          echo "ERROR: Failed to set permissions to 644 on $CONFIG_FILE" >&2
          exit 1
        fi

        echo "OK: $CONFIG_FILE permissions set to 644"
        EOF

        while IFS= read -r NODE; do
          [[ -z "$NODE" || "$NODE" =~ ^# ]] && continue

          echo "==== Remediating node: $NODE ===="
          ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "$NODE" "bash -s" <<< "$REMOTE_SCRIPT" || {
            echo "ERROR: Remediation failed on node $NODE" >&2
          }
          echo
        done < "$WORKER_LIST_FILE"
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>