Check ID: kubelet_service_file_ownership_root
Provider: Kubernetes
Service: kubelet
Severity: HIGH
Categories: node-security
Resource type: Node

​
What this check verifies

Kubernetes Kubelet service configuration on each node is expected to be owned by root. This assessment inspects the systemd drop-in at /etc/systemd/system/kubelet.service.d/kubeadm.conf and expects ownership root:root, ensuring only privileged users can modify kubelet startup settings.

​
Risk

Non-root ownership enables unauthorized changes to kubelet startup flags, degrading configuration integrity and service availability. Attackers could disable auth, expose ports, weaken TLS, or load rogue configs-leading to node compromise, credential theft (confidentiality), lateral movement, and cluster disruption.

​
Recommendation

Apply least privilege to node config: ensure the kubelet service file is root:root and writable only by root. Use configuration management to enforce permissions and detect drift, enable file integrity monitoring, harden the OS, and restrict privileged node access with separation of duties.

​
Remediation

sudo chown root:root /etc/systemd/system/kubelet.service.d/kubeadm.conf

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_service_file_ownership_root. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks