Back to Checks
kubernetes

Node kubelet.conf file ownership is set to root:root

kubelet_conf_file_ownership
Service: kubeletSeverity: high
OfficialBuilt-inVerified
Categories:node-security
Resource Type:Node

Kubernetes Node kubeconfig at /etc/kubernetes/kubelet.conf is evaluated for file ownership root:root. The check focuses on who owns the file that defines the kubelet's API client settings and certificates.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Non-root ownership lets local users alter kubelet API credentials and endpoints, enabling node impersonation, unauthorized control of Pods, and data exfiltration via the kubelet. This threatens integrity (config tampering), confidentiality (secrets access), and availability (pod eviction or node disruption).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_conf_file_ownership

Recommendation

Set /etc/kubernetes/kubelet.conf ownership to root:root and use restrictive perms (e.g., 600). Apply least privilege on node access, protect kubelet dirs, and enable file integrity monitoring. Use defense in depth: configuration management to enforce state and periodic audits to detect drift.

Remediation

CLI

chown root:root /etc/kubernetes/kubelet.conf

Other

1SSH into the affected node
2Run: sudo chown root:root /etc/kubernetes/kubelet.conf

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.lib.utils.utils import is_owned_by_root
from prowler.providers.kubernetes.services.core.core_client import core_client


class kubelet_conf_file_ownership(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for node in core_client.nodes.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=node)
            # It can only be checked if Prowler is being executed inside a worker node or if the file is the default one
            if node.inside:
                if is_owned_by_root("/etc/kubernetes/kubelet.conf") is None:
                    report.status = "MANUAL"
                    report.status_extended = f"kubelet.conf file not found in Node {node.name}, please verify kubelet.conf file ownership manually."
                else:
                    report.status = "PASS"
                    report.status_extended = f"kubelet.conf file ownership is set to root:root in Node {node.name}."
                    if not is_owned_by_root("/etc/kubernetes/kubelet.conf"):
                        report.status = "FAIL"
                        report.status_extended = f"kubelet.conf file ownership is not set to root:root in Node {node.name}."
            else:
                report.status = "MANUAL"
                report.status_extended = f"Prowler is not being executed inside Node {node.name}, please verify kubelet.conf file ownership manually."
            findings.append(report)
        return findings

References