cis-ocp-v180-4-1-1

name	cis-ocp-v180-4.1.1
description	Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated)
category	cis-openshift
version	1.8.0
author	cyberstrike-official
tags	["cis","openshift","kubernetes","redhat","worker-node","config-files"]
cis_id	4.1.1
cis_benchmark	CIS Red Hat OpenShift Container Platform Benchmark v1.8.0
tech_stack	["kubernetes","openshift","redhat"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Red Hat OpenShift Container Platform Benchmark v1.8.0 - Control 4.1.1

Profile Applicability

• Level: 1

Description

Ensure that the kubelet service file has permissions of 644 or more restrictive.

Rationale

The kubelet service file controls various parameters that set the behavior of the kubelet service in the worker node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.

Impact

None

Audit Procedure

Kubelet is run as a systemd unit and its configuration file is created with 644 permissions.

Run the following command:

for node in $(oc get nodes -o jsonpath='{.items[*].metadata.name}')
do
oc debug node/${node} -- chroot /host stat -c %a
/etc/systemd/system/kubelet.service
done

OR

for node in $(oc get nodes -o jsonpath='{.items[*].metadata.name}')
do
oc debug node/${node} -- chroot /host stat -c %a
/host/usr/lib/systemd/system/kubelet.service
done

Verify that the permissions are 644 or more restrictive.

Remediation

None.

Default Value

By default, the kubelet service file has permissions of 644.

References

1. https://docs.openshift.com/container-platform/4.5/architecture/control-plane.html#understanding-machine-config-operator_control-plane
2. https://docs.openshift.com/container-platform/4.5/scalability_and_performance/recommended-host-practices.html#create-a-kubeletconfig-crd-to-edit-kubelet-parameters_