The Kubernetes Kubelet certificate authority must be owned by root. (Cat II impact)
The Kubernetes kube proxy kubeconfig contain the argument and setting for the Master Nodes. These settings contain network rules for restricting network communication between pods, clusters, and networks. If these files can be changed, data traversing between the Kubernetes Control Panel components would be compromised. Many of the security settings within the document are implemented through this file.
Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Review the ownership of the Kubernetes client-ca-file by using the command: more kubelet --client-ca-file argument Note certificate location Review the ownership of the Kubernetes client-ca-file by using the command: stat -c %U:%G <location from --client-ca-file argument>| grep -v root:root If the command returns any non root:root file permissions, this is a finding.
Change the permissions of the Kube Proxy to "root" by executing the command: chown root:root <location from kubeconfig>.
Rule ID: SV-242450r754804_rule
Vulnerability ID: V-242450
Group Title: SRG-APP-000516-CTR-001325
The organization implements the security configuration settings.