| name | cis-gke-v170-3.1.4 |
| description | Ensure that the kubelet configuration file ownership is set to root:root (Automated) |
| category | cis-gke |
| version | 1.7.0 |
| author | cyberstrike-official |
| tags | ["cis","gke","kubernetes","gcp","worker-nodes","configuration-files","permissions","ownership","kubeconfig","kubelet"] |
| cis_id | 3.1.4 |
| cis_benchmark | CIS Google Kubernetes Engine (GKE) Benchmark v1.7.0 |
| tech_stack | ["kubernetes","gcp","gke"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
3.1.4 Ensure that the kubelet configuration file ownership is set to root:root (Automated)
Profile Applicability
Description
Ensure that if the kubelet configuration file exists, it is owned by root:root.
Rationale
The kubelet reads various parameters, including security settings, from a config file specified by the --config argument. If this file is specified you should restrict its file permissions to maintain the integrity of the file. The file should be owned by root:root.
Impact
Overly permissive file access increases security risk to the platform.
Audit
Using Google Cloud Console
- Go to Kubernetes Engine by visiting https://console.cloud.google.com/kubernetes/list
- Click on the desired cluster to open the Details page, then click on the desired Node pool to open the Node pool Details page
- Note the name of the desired node
- Go to VM Instances by visiting https://console.cloud.google.com/compute/instances
- Find the desired node and click on 'SSH' to open an SSH connection to the node.
Using Command Line
Method 1
First, SSH to the relevant worker node.
To check to see if the Kubelet Service is running:
sudo systemctl status kubelet
The output should return Active: active (running) since...
Run the following command on each node to find the appropriate Kubelet config file:
ps -ef | grep kubelet
The output of the above command should return something similar to --config /etc/kubernetes/kubelet/kubelet-config.yaml which is the location of the Kubelet config file.
Run the following command:
stat -c %U:%G /etc/kubernetes/kubelet/kubelet-config.yaml
The output of the above command is the Kubelet config file's ownership. Verify that the ownership is set to root:root.
Method 2
Create and Run a Privileged Pod.
You will need to run a pod that is privileged enough to access the host's file system. This can be achieved by deploying a pod that uses the hostPath volume to mount the node's file system into the pod.
