Profile applicability: Level 1 - Worker Node
Ensure that the
kubelet.conf
file ownership is set to
root:root
.The
kubelet.conf
file is the kubeconfig file for the node, and controls
various parameters that set the behavior and identity of the worker node. You should
set its file
ownership to maintain the integrity of the file. The file should be owned by
root:root
.
NoteBy default,
kubelet.conf file ownership is set to
root:root . |
Audit
Automated AAC auditing has been modified to allow CIS-CAT to input a variable for
the
<PATH>/<FILENAME> of the kubelet config file. Set $kubelet_config=<PATH> based on
the
file location on your system:
export kubelet_config=/etc/kubernetes/kubelet.conf
To perform the audit manually, run the below command (based on the file location on
your
system) on the each worker node:
stat -c %U:%G /etc/kubernetes/kubelet.conf
Verify that the ownership is set to
root:root
.Remediation
Run the below command (based on the file location on your system) on the each worker
node:
chown root:root /etc/kubernetes/kubelet.conf