Check ID: kubelet_config_yaml_permissions
Provider: Kubernetes
Service: kubelet
Severity: HIGH
Categories: node-security
Resource type: Node

​
What this check verifies

Kubernetes Kubelet configuration file (/var/lib/kubelet/config.yaml) is evaluated for restrictive file permissions. When kubelet uses --config, the file is expected to be owner-only readable/writable (600) or more restrictive.

​
Risk

Overly permissive kubelet config permissions allow unauthorized reads or edits. Attackers could extract credentials, adjust auth settings, or change node behavior, leading to data exposure (C), configuration tampering (I), and potential service disruption (A).

​
Recommendation

Apply least privilege to the kubelet config:
  • Set mode 600 or stricter
  • Ensure trusted ownership; deny group/world access
  • Harden the parent directory
  • Enforce via config management and file integrity monitoring
  • Limit interactive access to worker nodes

​
Remediation

chmod 600 /var/lib/kubelet/config.yaml

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_config_yaml_permissions. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks