The kubeconfig file should have permissions set to 644 or more restrictive

eks
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

AWS EKS worker node kubeconfig files should have permissions set to 644 or more restrictive. The kubelet kubeconfig file contains authentication credentials the kubelet uses to connect to the Kubernetes API server, so restricting write access to administrators preserves the integrity of the kubelet configuration and reduces the risk of malicious alterations that could compromise the cluster.

Remediation

On each worker node, run the following command (adjusting the path to the kubeconfig file location on your system) to restrict the file permissions. See the Kubernetes cluster hardening documentation for more detail.

chmod 644 /var/lib/kubelet/kubeconfig

Note: The path above is the default location in EKS.

References