Back to Checks
kubernetes

Node kubelet config.yaml file ownership is root:root

kubelet_config_yaml_ownership
Service: kubeletSeverity: high
OfficialBuilt-inVerified
Categories:node-securitycluster-security
Resource Type:Node

Kubernetes Kubelet configuration file config.yaml (e.g., /var/lib/kubelet/config.yaml) is evaluated to confirm ownership by root:root when the kubelet uses a config file via --config.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Non-root ownership of kubelet config.yaml enables local users or daemons to alter node-agent settings, affecting confidentiality, integrity, and availability. They could weaken authN/Z, enable insecure ports, or redirect certificate paths, leading to node takeover, lateral movement, data exfiltration, and workload disruption.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_config_yaml_ownership

Recommendation

Enforce root:root ownership with restrictive permissions on the kubelet config. Apply least privilege and separation of duties so only trusted admins/processes can write. Use centralized, immutable configuration, monitor with integrity/audit logs, and limit interactive access to nodes for defense in depth.

Remediation

CLI

chown root:root /var/lib/kubelet/config.yaml

Other

1SSH into the Kubernetes node running the kubelet
2Set ownership to root:root:
3```bash
4sudo chown root:root /var/lib/kubelet/config.yaml
5```

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.lib.utils.utils import is_owned_by_root
from prowler.providers.kubernetes.services.core.core_client import core_client


class kubelet_config_yaml_ownership(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for node in core_client.nodes.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=node)
            # It can only be checked if Prowler is being executed inside a worker node or if the file is the default one
            if node.inside:
                if is_owned_by_root("/var/lib/kubelet/config.yaml") is None:
                    report.status = "MANUAL"
                    report.status_extended = f"Kubelet config.yaml file not found in Node {node.name}, please verify kubelet config.yaml file ownership manually."
                else:
                    report.status = "PASS"
                    report.status_extended = f"kubelet config.yaml file ownership is set to root:root in Node {node.name}."
                    if not is_owned_by_root("/var/lib/kubelet/config.yaml"):
                        report.status = "FAIL"
                        report.status_extended = f"kubelet config.yaml file ownership is set to root:root in Node {node.name}."
            else:
                report.status = "MANUAL"
                report.status_extended = f"Prowler is not being executed inside Node {node.name}, please verify kubelet config.yaml file permissions manually."
            findings.append(report)
        return findings

References