Back to Checks
kubernetes

Kubelet config.yaml file permissions on the node are set to 600 or more restrictive

kubelet_config_yaml_permissions
Service: kubeletSeverity: high
OfficialBuilt-inVerified
Categories:node-security
Resource Type:Node

Kubernetes Kubelet configuration file (/var/lib/kubelet/config.yaml) is evaluated for restrictive file permissions. When kubelet uses --config, the file is expected to be owner-only readable/writable (600) or more restrictive.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Overly permissive kubelet config permissions allow unauthorized reads or edits. Attackers could extract credentials, adjust auth settings, or change node behavior, leading to data exposure (C), configuration tampering (I), and potential service disruption (A).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_config_yaml_permissions

Recommendation

Apply least privilege to the kubelet config:

  • Set mode 600 or stricter
  • Ensure trusted ownership; deny group/world access
  • Harden the parent directory
  • Enforce via config management and file integrity monitoring
  • Limit interactive access to worker nodes

Remediation

CLI

chmod 600 /var/lib/kubelet/config.yaml

Other

1SSH into the affected node with sufficient privileges
2Set the file permission:
3```bash
4sudo chmod 600 /var/lib/kubelet/config.yaml
5```
6Verify:
7```bash
8stat -c "%a" /var/lib/kubelet/config.yaml
9# should output: 600
10```

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.lib.utils.utils import get_file_permissions
from prowler.providers.kubernetes.services.core.core_client import core_client


class kubelet_config_yaml_permissions(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for node in core_client.nodes.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=node)
            # It can only be checked if Prowler is being executed inside a worker node or if the file is the default one
            if node.inside:
                if not get_file_permissions("/var/lib/kubelet/config.yaml"):
                    report.status = "MANUAL"
                    report.status_extended = f"Kubelet config.yaml file not found in Node {node.name}, please verify kubelet config.yaml file permissions manually."
                else:
                    report.status = "PASS"
                    report.status_extended = f"kubelet config.yaml file permissions are set to 600 or more restrictive in Node {node.name}."
                    if get_file_permissions("/var/lib/kubelet/config.yaml") > 0o600:
                        report.status = "FAIL"
                        report.status_extended = f"kubelet config.yaml file permissions are not set to 600 or more restrictive in Node {node.name}."
            else:
                report.status = "MANUAL"
                report.status_extended = f"Prowler is not being executed inside Node {node.name}, please verify kubelet config.yaml file permissions manually."
            findings.append(report)
        return findings

References