The kubeconfig file ownership should be assigned to root

eks
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

Kubelet kubeconfig file ownership should be assigned to root:root on every EKS worker node. The kubeconfig file (typically located at /var/lib/kubelet/kubeconfig) is used by the kubelet to authenticate to the API server, and restricting its ownership to root preserves its integrity.

Remediation

Run the below command (based on the file location on your system) on each worker node to set the kubeconfig file ownership to root:root. See the Kubernetes cluster hardening documentation for more detail.

chown root:root /var/lib/kubelet/kubeconfig

Note: The path above is the default location in EKS.

References