> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet Kubeconfig File Permissions Set To 644 Or More Restrictive

### More Info:

The kubelet kubeconfig file should have permissions of 644 or more restrictive. Loose permissions could allow unauthorized users to read or alter the kubelets cluster credentials.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS OKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check the current permissions of the kubelet kubeconfig file:
           ```bash theme={null}
           stat -c permissions=%a /var/lib/kubelet/kubeconfig
           ```

        2. If the file exists and permissions are more permissive than 644 (e.g., 664, 666, 777), set them to 644:
           ```bash theme={null}
           chmod 644 /var/lib/kubelet/kubeconfig
           ```

        3. Ensure the file is owned by the kubelet user and group (commonly root:root; adjust if your environment differs):
           ```bash theme={null}
           chown root:root /var/lib/kubelet/kubeconfig
           ```

        4. Repeat steps 1–3 on each worker node in the cluster.

        5. Verification (on every worker node):
           ```bash theme={null}
           stat -c permissions=%a /var/lib/kubelet/kubeconfig
           ```
           Confirm the output shows:
           ```text theme={null}
           permissions=644
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        This file’s permissions are set on each worker node’s filesystem and cannot be changed via kubectl or any Kubernetes API object. To remediate, adjust the file mode directly on the node (host-level fix); see the Manual Steps section for the exact commands to run on every worker node.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix CIS OKE 3.1.1: Ensure kubelet kubeconfig file permissions are 644 or more restrictive
        # Target: every worker node
        #
        # Run this script on each worker node (e.g., via SSH, Ansible shell, or your CM tool).
        # It is safe to re-run.

        set -euo pipefail

        KUBELET_KUBECONFIG="/var/lib/kubelet/kubeconfig"   # Affected resource from finding
        LEGACY_PATH="/etc/kubernetes/kubelet.conf"         # Path used by audit example/remediation
        DESIRED_MODE="644"

        change_mode_if_exists() {
          local path="$1"
          if [ -e "${path}" ]; then
            current_mode="$(stat -c '%a' "${path}")" || current_mode="UNKNOWN"
            echo "Found kubelet kubeconfig at: ${path} (current mode: ${current_mode})"

            if [ "${current_mode}" != "${DESIRED_MODE}" ]; then
              echo "Setting permissions to ${DESIRED_MODE} on ${path}"
              chmod "${DESIRED_MODE}" "${path}"
            else
              echo "Permissions already ${DESIRED_MODE} on ${path}; no change needed"
            fi
          else
            echo "Path not present, skipping: ${path}"
          fi
        }

        echo "=== Adjusting kubelet kubeconfig permissions on this node ==="

        # Handle both the finding's path and the benchmark's example path
        change_mode_if_exists "${KUBELET_KUBECONFIG}"
        change_mode_if_exists "${LEGACY_PATH}"

        echo
        echo "=== Verification ==="

        if [ -e "${KUBELET_KUBECONFIG}" ]; then
          echo "Verifying ${KUBELET_KUBECONFIG}:"
          stat -c 'permissions=%a %n' "${KUBELET_KUBECONFIG}"
        fi

        if [ -e "${LEGACY_PATH}" ]; then
          echo "Verifying ${LEGACY_PATH}:"
          stat -c 'permissions=%a %n' "${LEGACY_PATH}"
        fi

        echo
        echo "Expected: permissions=644 for any kubelet kubeconfig file present on this worker node."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>