kubelet.conf permissions are 600 or more restrictive

​

What this check verifies

Kubernetes Kubelet kubeconfig at /etc/kubernetes/kubelet.conf must have owner-only permissions (0600 or stricter). The check evaluates the file mode to ensure it is not more permissive than 0600.

​

Risk

Overly permissive kubelet.conf exposes kubelet credentials, allowing local users or malware to act as the node.

• Integrity: modify workloads or node state
• Confidentiality: access secrets/metadata
• Availability: disrupt scheduling or drain nodes

​

Recommendation

Apply least privilege to /etc/kubernetes/kubelet.conf:

• Set permissions to 0600 or stricter
• Restrict ownership to the kubelet user; no group/world access
• Limit shell access and monitor file changes
• Layer controls with RBAC and certificate/key rotation

​

Remediation

​

References

• https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/kubelet-integration/
• https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_conf_file_permissions. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks