Skip to content

4111-k8s-apiserver-conf-priv-apiserver Configuration File Permissions Not Set to 644 or More Restrictive

Rule ID

  • 4111-k8s-apiserver-conf-priv

Category

  • container

Severity

  • warn

Compatible Versions

  • Linux

Description

  • If you are using Kubernetes apiserver on a machine managed by systemd, verify that the kubernetes.service file permissions are correctly set to 644 or more restrictive.

Scan Frequency

  • 0 */30 * * *

Rationale

  • The kubernetes.apiserver file contains sensitive parameters that can alter the behavior of the Kubernetes daemon. Therefore, no user other than root should be able to write to it in order to maintain file integrity.

Risk Item

  • Container Security

Audit Method

  • Execute the following command to verify that the file permissions are set to 644 or more restrictive:
stat -c %a /etc/kubernetes/manifests/kube-apiserver.yaml

Remediation

  • Execute the following command to modify the permissions of the three configuration files:
#> chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml

This sets the file permissions to 644.

Impact

  • None

Default Value

  • By default, the permissions of kube-apiserver.yaml are 640.

References

CIS Controls

  • None

Feedback

Is this page helpful?