Back to Checks
kubernetes

Node kubelet service file permissions are set to 600 or more restrictive

kubelet_service_file_permissions
Service: kubeletSeverity: high
OfficialBuilt-inVerified
Categories:node-security
Resource Type:Node

Kubernetes Kubelet service file on worker nodes is assessed for restrictive permissions of 600 or tighter. The evaluation reviews the kubelet systemd drop-in configuration to confirm only the owner has read/write access and no broader permissions are granted.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Excess permissions let local users alter kubelet startup options, undermining integrity and availability. Attackers could enable insecure ports, weaken auth/TLS, or inject flags, leading to node compromise, pod tampering, and lateral movement that threatens cluster confidentiality.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_service_file_permissions

Recommendation

Apply least privilege: set the kubelet service file to 600 with root control to block group/other access. Enforce via configuration management, restrict administrative shell access to nodes, and monitor with file integrity alerts. Use defense in depth by maintaining strong kubelet auth and TLS settings.

Remediation

CLI

chmod 600 /etc/systemd/system/kubelet.service.d/kubeadm.conf

Other

1SSH to the affected Kubernetes node as a privileged user
2Set the kubelet service file permissions: `chmod 600 /etc/systemd/system/kubelet.service.d/kubeadm.conf`
3Repeat on each node where this file exists

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.lib.utils.utils import get_file_permissions
from prowler.providers.kubernetes.services.core.core_client import core_client


class kubelet_service_file_permissions(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for node in core_client.nodes.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=node)
            # It can only be checked if Prowler is being executed inside a worker node or if the file is the default one
            if node.inside:
                if not get_file_permissions(
                    "/etc/systemd/system/kubelet.service.d/kubeadm.conf"
                ):
                    report.status = "MANUAL"
                    report.status_extended = f"Kubelet service file not found in Node {node.name}, please verify Kubelet service file permissions manually."
                else:
                    report.status = "PASS"
                    report.status_extended = f"Kubelet service file permissions are set to 600 or more restrictive in Node {node.name}."
                    if (
                        get_file_permissions(
                            "/etc/systemd/system/kubelet.service.d/kubeadm.conf"
                        )
                        > 0o600
                    ):
                        report.status = "FAIL"
                        report.status_extended = f"Kubelet service file permissions are not set to 600 or more restrictive in Node {node.name}."
            else:
                report.status = "MANUAL"
                report.status_extended = f"Prowler is not being executed inside Node {node.name}, please verify Kubelet service file permissions manually."
            findings.append(report)
        return findings

References