Controller Manager Pod Specification File Permissions Should Be 600 Or More Restrictive

Manual Steps

On every control plane node, confirm the controller manager manifest file exists and note its current permissions:
sudo ls -l /etc/kubernetes/manifests/kube-controller-manager.yaml

On every control plane node, set the file permissions to 600:

sudo chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml

(Optional) On every control plane node, set the file owner and group to root (if not already) to further restrict access:
sudo chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml
Be aware: modifying a static pod manifest under /etc/kubernetes/manifests may cause the kubelet to detect and restart the kube-controller-manager pod if it sees the file as changed. Perform this during a maintenance window if your environment is sensitive to control plane component restarts.
On every control plane node, verify the permissions are now 600 or more restrictive:
stat -c permissions=%a /etc/kubernetes/manifests/kube-controller-manager.yaml
Confirm the output shows permissions=600 (or a more restrictive value such as permissions=400).

Using kubectl

kubectl cannot modify file permissions on control plane hosts, including /etc/kubernetes/manifests/kube-controller-manager.yaml. This must be fixed directly on every control plane node at the host level; follow the guidance in the Manual Steps section to update the file mode and verify it.

Automation

#!/usr/bin/env bash
#
# Fixes CIS Kubernetes 1.1.3:
# Ensures /etc/kubernetes/manifests/kube-controller-manager.yaml has permissions 600
# Run this on every control plane node.
# Safe to re-run (idempotent).

set -euo pipefail

TARGET_FILE="/etc/kubernetes/manifests/kube-controller-manager.yaml"
REQUIRED_MODE="600"
EXIT_CODE=0

echo "=== CIS 1.1.3: kube-controller-manager manifest permissions ==="

if [ ! -e "$TARGET_FILE" ]; then
  echo "SKIP: $TARGET_FILE does not exist on this node."
  exit 0
fi

# Show current permissions
CURRENT_MODE=$(stat -c '%a' "$TARGET_FILE")
echo "Current permissions for $TARGET_FILE: $CURRENT_MODE"

# Apply fix only if needed
if [ "$CURRENT_MODE" != "$REQUIRED_MODE" ]; then
  echo "Updating permissions to $REQUIRED_MODE ..."
  chmod "$REQUIRED_MODE" "$TARGET_FILE"
fi

# Verification (from benchmark audit logic)
VERIFY_OUTPUT=$(stat -c 'permissions=%a' "$TARGET_FILE")
echo "Verification: $VERIFY_OUTPUT"

if [ "$VERIFY_OUTPUT" != "permissions=$REQUIRED_MODE" ]; then
  echo "ERROR: Failed to set required permissions ($REQUIRED_MODE) on $TARGET_FILE" >&2
  EXIT_CODE=1
else
  echo "SUCCESS: $TARGET_FILE permissions are set to $REQUIRED_MODE"
fi

exit $EXIT_CODE

Kubernetes

Kubernetes Misconfigurations

Controller Manager Pod Specification File Permissions Should Be 600 Or More Restrictive

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation