Check ID: kubelet_config_yaml_ownership
Provider: Kubernetes
Service: kubelet
Severity: HIGH
Categories: node-security, cluster-security
Resource type: Node

​
What this check verifies

Kubernetes Kubelet configuration file config.yaml (e.g., /var/lib/kubelet/config.yaml) is evaluated to confirm ownership by root:root when the kubelet uses a config file via --config.

​
Risk

Non-root ownership of kubelet config.yaml enables local users or daemons to alter node-agent settings, affecting confidentiality, integrity, and availability. They could weaken authN/Z, enable insecure ports, or redirect certificate paths, leading to node takeover, lateral movement, data exfiltration, and workload disruption.

​
Recommendation

Enforce root:root ownership with restrictive permissions on the kubelet config. Apply least privilege and separation of duties so only trusted admins/processes can write. Use centralized, immutable configuration, monitor with integrity/audit logs, and limit interactive access to nodes for defense in depth.

​
Remediation

chown root:root /var/lib/kubelet/config.yaml

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_config_yaml_ownership. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks