Verify Permissions on the Kubernetes Scheduler Kubeconfig File
An XCCDF Rule
Description
To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig, run the command:
$ sudo chmod 0600 /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig
warning alert: Dependency Warning
This rule is only applicable for nodes that run the Kubernetes Scheduler service.
The aforementioned service is only running on the nodes labeled
"master" by default.
Rationale
The kubeconfig for the Scheduler contains parameters for the scheduler to access the Kube API. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.
- ID
- xccdf_org.ssgproject.content_rule_file_permissions_scheduler_kubeconfig
- Severity
- Medium
- References
- Updated