Certificate Authorities File Permissions Set To 644 Or More Restrictive

Manual Steps

On every worker node, identify the kubelet client CA file path (in case it differs from the default):
ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file=
If no --client-ca-file flag is present, the default path is /etc/kubernetes/pki/ca.crt.
On every worker node, set the permissions of the CA file to 644 (readable by all, writable only by owner). Use the actual path if different from the default:
chmod 644 /etc/kubernetes/pki/ca.crt
On every worker node, confirm the owner and group are appropriate for your environment (commonly root:root), adjusting if necessary:
ls -l /etc/kubernetes/pki/ca.crt
If you need to change ownership (example for root:root):
chown root:root /etc/kubernetes/pki/ca.crt

On every worker node, verify the permissions now meet the benchmark (644 or more restrictive), using an adapted version of the audit command:

CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
if test -z "$CAFILE"; then CAFILE=/etc/kubernetes/pki/ca.crt; fi
if test -e "$CAFILE"; then stat -c permissions=%a "$CAFILE"; fi

Ensure the output shows permissions=644 or a more restrictive value (e.g., 600, 640).

Using kubectl

kubectl cannot modify file permissions on worker node files such as /etc/kubernetes/pki/ca.crt; this must be fixed directly on each worker node’s host filesystem. Use the guidance in the Manual Steps section on every worker node to set the correct permissions and then re-run the audit command to verify.

Automation

#!/usr/bin/env bash
#
# Purpose: Ensure kubelet client CA file permissions are 644 or more restrictive
# Scope:   Run on every worker node
# Safe:    Idempotent; can be re-run
#

set -euo pipefail

echo "==> Detecting kubelet client CA file..."

CAFILE="$(
  ps -ef \
    | grep kubelet \
    | grep -v apiserver \
    | grep -- '--client-ca-file=' \
    | awk -F '--client-ca-file=' '{print $2}' \
    | awk '{print $1}' \
    | uniq
)"

if [ -z "${CAFILE}" ]; then
  CAFILE="/etc/kubernetes/pki/ca.crt"
fi

if [ ! -e "${CAFILE}" ]; then
  echo "ERROR: Client CA file not found at ${CAFILE}. Nothing changed."
  exit 1
fi

echo "==> Using client CA file: ${CAFILE}"

# Get current permissions in numeric form (e.g. 640, 644, 600)
CURRENT_PERMS="$(stat -c '%a' "${CAFILE}")"
echo "==> Current permissions: ${CURRENT_PERMS}"

TARGET_PERMS="644"

if [ "${CURRENT_PERMS}" != "${TARGET_PERMS}" ]; then
  echo "==> Setting permissions to ${TARGET_PERMS} on ${CAFILE}"
  chmod "${TARGET_PERMS}" "${CAFILE}"
else
  echo "==> Permissions already ${TARGET_PERMS}; no change needed."
fi

echo "==> Verifying permissions..."

# Re-run the benchmark audit logic to confirm

CAFILE_VERIFY="$(
  ps -ef \
    | grep kubelet \
    | grep -v apiserver \
    | grep -- '--client-ca-file=' \
    | awk -F '--client-ca-file=' '{print $2}' \
    | awk '{print $1}' \
    | uniq
)"

if [ -z "${CAFILE_VERIFY}" ]; then
  CAFILE_VERIFY="/etc/kubernetes/pki/ca.crt"
fi

if [ -e "${CAFILE_VERIFY}" ]; then
  PERMS_VERIFY="$(stat -c 'permissions=%a' "${CAFILE_VERIFY}")"
  echo "==> Audit result: ${PERMS_VERIFY}"
else
  echo "ERROR: Verification failed; file ${CAFILE_VERIFY} not found."
  exit 1
fi

if [ "${PERMS_VERIFY}" != "permissions=644" ]; then
  echo "ERROR: Expected permissions=644 but got ${PERMS_VERIFY}"
  exit 1
fi

echo "==> Success: kubelet client CA file permissions are set to 644."

Kubernetes

Kubernetes Misconfigurations

Certificate Authorities File Permissions Set To 644 Or More Restrictive

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation