Back to Checks
kubernetes

Node kubelet.conf file permissions are set to 600 or more restrictive

kubelet_conf_file_permissions
Service: kubeletSeverity: high
OfficialBuilt-inVerified
Categories:node-security
Resource Type:Node

Kubernetes Kubelet kubeconfig at /etc/kubernetes/kubelet.conf must have owner-only permissions (0600 or stricter). The check evaluates the file mode to ensure it is not more permissive than 0600.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Overly permissive kubelet.conf exposes kubelet credentials, allowing local users or malware to act as the node.

  • Integrity: modify workloads or node state
  • Confidentiality: access secrets/metadata
  • Availability: disrupt scheduling or drain nodes

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_conf_file_permissions

Recommendation

Apply least privilege to /etc/kubernetes/kubelet.conf:

  • Set permissions to 0600 or stricter
  • Restrict ownership to the kubelet user; no group/world access
  • Limit shell access and monitor file changes
  • Layer controls with RBAC and certificate/key rotation

Remediation

CLI

sudo chmod 600 /etc/kubernetes/kubelet.conf

Other

1SSH into the node running kubelet
2Set restrictive permissions:
3```
4sudo chmod 600 /etc/kubernetes/kubelet.conf
5```
6Verify it reads 600:
7```
8stat -c "%a %n" /etc/kubernetes/kubelet.conf
9```

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.lib.utils.utils import get_file_permissions
from prowler.providers.kubernetes.services.core.core_client import core_client


class kubelet_conf_file_permissions(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for node in core_client.nodes.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=node)
            # It can only be checked if Prowler is being executed inside a worker node or if the file is the default one
            if node.inside:
                if not get_file_permissions("/etc/kubernetes/kubelet.conf"):
                    report.status = "MANUAL"
                    report.status_extended = f"Kubelet.conf file not found in Node {node.name}, please verify kubelet.conf file permissions manually."
                else:
                    report.status = "PASS"
                    report.status_extended = f"kubelet.conf file permissions are set to 600 or more restrictive in Node {node.name}."
                    if get_file_permissions("/etc/kubernetes/kubelet.conf") > 0o600:
                        report.status = "FAIL"
                        report.status_extended = f"kubelet.conf file permissions are not set to 600 or more restrictive in Node {node.name}."
            else:
                report.status = "MANUAL"
                report.status_extended = f"Prowler is not being executed inside Node {node.name}, please verify kubelet.conf file permissions manually."
            findings.append(report)
        return findings

References