Skip to content

Verify Permissions on the Worker Certificate Authority File

An XCCDF Rule

Description

To properly set the permissions of /etc/kubernetes/kubelet-ca.crt, run the command:

$ sudo chmod 0644 /etc/kubernetes/kubelet-ca.crt

Rationale

If the worker certificate authority file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the certificate authority certificate for an OpenShift node that is configured on the system. Protection of this file is critical for OpenShift security.

ID
xccdf_org.ssgproject.content_rule_file_permissions_worker_ca
Severity
Medium
References
Updated