Check ID: kubelet_conf_file_ownership
Provider: Kubernetes
Service: kubelet
Severity: HIGH
Categories: node-security
Resource type: Node

​
What this check verifies

Kubernetes Node kubeconfig at /etc/kubernetes/kubelet.conf is evaluated for file ownership root:root. The check focuses on who owns the file that defines the kubelet’s API client settings and certificates.

​
Risk

Non-root ownership lets local users alter kubelet API credentials and endpoints, enabling node impersonation, unauthorized control of Pods, and data exfiltration via the kubelet. This threatens integrity (config tampering), confidentiality (secrets access), and availability (pod eviction or node disruption).

​
Recommendation

Set /etc/kubernetes/kubelet.conf ownership to root:root and use restrictive perms (e.g., 600). Apply least privilege on node access, protect kubelet dirs, and enable file integrity monitoring. Use defense in depth: configuration management to enforce state and periodic audits to detect drift.

​
Remediation

chown root:root /etc/kubernetes/kubelet.conf

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_conf_file_ownership. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks