4122-k8s-etcd-dir-ownership - k8s-etcd file ownership not set to etcd:etcd¶

Rule ID¶

• 4122-k8s-etcd-dir-ownership

Category¶

• container

Severity¶

• warn

Compatible Versions¶

• Linux

Description¶

• If k8s-etcd is used on a machine managed by systemd, verify that the k8s-etcd file ownership and group ownership are correctly set to etcd.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• The k8s-etcd file contains sensitive parameters that could alter the behavior of the k8s-etcd daemon. Therefore, it should be owned by root, and the group should be root to maintain the file's integrity.

Risk Items¶

• Container Security

Audit Procedure¶

• Run the following command to verify that the file and group are owned by root:

stat -c %U:%G /var/lib/etcd

The above command should return nothing.

Remediation¶

• Run the following command:

#> chown etcd:etcd /var/lib/etcd

This sets the file ownership and group ownership to root.

Impact¶

• None

Default Value¶

• This file may not exist on the system. In that case, this recommendation does not apply. By default, if the file exists, its ownership and group ownership are correctly set to root:root.

References¶

• etcd
• kubernetes-etcd

CIS Controls¶

• None