0402-kubeproxy-conf-priv-proxy kubeconfig file permissions not set to 644 or higher¶

Rule ID¶

• 0402-kubeproxy-conf-priv

Category¶

• container

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• If you are using kube-proxy on a machine managed by systemd, verify that the proxy kubeconfig file permissions are correctly set to 644 or more restrictive.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• The kube-proxy file contains sensitive parameters that may alter the behavior of the kube-proxy daemon. Therefore, no user other than root should be able to write to it to maintain file integrity.

Risk Item¶

• Container Security

Audit Method¶

• Execute the following command to verify the file permissions are set to "644" or more restrictive:

stat -c %a /var/lib/kube-proxy/config.conf

Remediation¶

• Execute the following command:

  #> chmod 644 /var/lib/kube-proxy/config.conf
  

  This sets the file permissions to "644".

Impact¶

• None

Default Value¶

• This file may not exist on the system. In that case, this recommendation does not apply. By default, if the file exists, the file permissions are correctly set to 644.

References¶

• kube-proxy

CIS Control¶

• None