Check ID: kubelet_service_file_permissions
Provider: Kubernetes
Service: kubelet
Severity: HIGH
Categories: node-security
Resource type: Node

​
What this check verifies

Kubernetes Kubelet service file on worker nodes is assessed for restrictive permissions of 600 or tighter. The evaluation reviews the kubelet systemd drop-in configuration to confirm only the owner has read/write access and no broader permissions are granted.

​
Risk

Excess permissions let local users alter kubelet startup options, undermining integrity and availability. Attackers could enable insecure ports, weaken auth/TLS, or inject flags, leading to node compromise, pod tampering, and lateral movement that threatens cluster confidentiality.

​
Recommendation

Apply least privilege: set the kubelet service file to 600 with root control to block group/other access. Enforce via configuration management, restrict administrative shell access to nodes, and monitor with file integrity alerts. Use defense in depth by maintaining strong kubelet auth and TLS settings.

​
Remediation

chmod 600 /etc/systemd/system/kubelet.service.d/kubeadm.conf

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_service_file_permissions. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks