Default Administrative Credential File Permissions Should Be 600

Manual Steps

On every control plane node, check the current permissions of the default admin kubeconfig files:

for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
  if test -e "$adminconf"; then
    stat -c "permissions=%a %n" "$adminconf"
  fi
done

On every control plane node, restrict permissions on admin.conf so only the owner can read and write it:
if test -e /etc/kubernetes/admin.conf; then chmod 600 /etc/kubernetes/admin.conf fi
On every control plane node running Kubernetes 1.29 or later, also restrict permissions on super-admin.conf (if present):
if test -e /etc/kubernetes/super-admin.conf; then chmod 600 /etc/kubernetes/super-admin.conf fi

On every control plane node, confirm that only the intended user (typically root) owns these files and that group/others do not have access:

for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
  if test -e "$adminconf"; then
    ls -l "$adminconf"
  fi
done

On every control plane node, re-run the permissions check to verify remediation:

for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
  if test -e "$adminconf"; then
    stat -c "permissions=%a %n" "$adminconf"
  fi
done

Using kubectl

kubectl cannot modify file permissions on control plane nodes, so it cannot be used to fix /etc/kubernetes/admin.conf or /etc/kubernetes/super-admin.conf. File mode changes must be made directly on each control plane node’s filesystem; see the Manual Steps section for the exact commands to run over SSH.

Automation

#!/usr/bin/env bash
# Fix CIS Kubernetes 1.1.13: ensure admin.conf and super-admin.conf are 600
# Run on every control plane node (as root).

set -euo pipefail

ADMIN_FILES=(
  "/etc/kubernetes/admin.conf"
  "/etc/kubernetes/super-admin.conf"
)

changed=0

echo "==> Ensuring permissions 600 on default administrative kubeconfig files"

for f in "${ADMIN_FILES[@]}"; do
  if [ -e "$f" ]; then
    current_perm=$(stat -c "%a" "$f")
    if [ "$current_perm" != "600" ]; then
      echo " - Updating $f permissions from $current_perm to 600"
      chmod 600 "$f"
      changed=1
    else
      echo " - $f already has permissions 600"
    fi
  else
    echo " - $f does not exist on this node, skipping"
  fi
done

echo
echo "==> Verifying resulting permissions"
for f in "${ADMIN_FILES[@]}"; do
  if [ -e "$f" ]; then
    stat -c "permissions=%a %n" "$f"
  fi
done

if [ "$changed" -eq 0 ]; then
  echo "==> No changes were necessary; all existing files already compliant."
else
  echo "==> Permissions updated where necessary."
fi

Kubernetes

Kubernetes Misconfigurations

Default Administrative Credential File Permissions Should Be 600

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation