The Kubernetes kubelet config must be owned by root.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-242457	CNTR-K8-003240	SV-242457r961863_rule		Medium

Description

The Kubernetes kubelet agent registers nodes with the API Server and performs health checks to containers within pods. If this file can be modified, the information system would be unaware of pod or container degradation.

STIG	Date
Kubernetes Security Technical Implementation Guide	2024-08-22

Details

Check Text (C-45732r712725_chk)

Review the Kubernetes Kubeadm kubelet conf file by using the command:

stat -c %U:%G /var/lib/kubelet/config.yaml| grep -v root:root

If the command returns any non root:root file permissions, this is a finding.

Fix Text (F-45690r712726_fix)

Change the ownership of the kubelet config to "root: root" by executing the command:

chown root:root /var/lib/kubelet/config.yaml