Kubernetes Security Technical Implementation Guide

The Kubernetes Security Technical Implementation Guide (V2 R6) has 92 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

92STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R6

CurrentPublished Wed Apr 01 2026

The Kubernetes KubeletConfiguration file must be owned by root.

Kubernetes Security Technical Implementation Guide

Assessment Title

Rule Text

The Kubernetes KubeletConfiguration file must be owned by root.

Description

Discussion Text

The kubelet configuration file contains the runtime configuration of the kubelet service. If an attacker can gain access to this file, changes can be made to open vulnerabilities and bypass user authorizations inherent within Kubernetes with RBAC implemented.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-242406

Rule

SV-242406r960960_rule

Severity

medium

Rule Version

CNTR-K8-000880

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

On the Kubernetes Control Plane and Worker nodes, run the command:
ps -ef | grep kubelet

Check the config file (path identified by: --config):

Change to the directory identified by --config (example /etc/sysconfig/) run the command:
ls -l kubelet

Each kubelet configuration file must be owned by root:root.

If any manifest file is not owned by root:root, this is a finding.

Implementation Procedure

Fix Text

On the Control Plane and Worker nodes, change to the --config directory. Run the command:
chown root:root kubelet

To verify the change took place, run the command:
ls -l kubelet

The kubelet file should now be owned by root:root.

STIG check 28 of 92 in the Kubernetes STIG checklist

← Previous · V-242405The Kubernetes manifests must be owned by root.Next · V-242407 →The Kubernetes KubeletConfiguration files must have file permissions set to 644 or more restrictive.