The kubeconfig file should have permissions set to 644 or more restrictive

eks
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Description

AWS EKS worker node kubeconfig files should have permissions set to 644 or more restrictive. The kubelet kubeconfig file contains authentication credentials the kubelet uses to connect to the Kubernetes API server, so restricting write access to administrators preserves the integrity of the kubelet configuration and reduces the risk of malicious alterations that could compromise the cluster.

Remediation

On each worker node, run the following command (adjusting the path to the kubeconfig file location on your system) to restrict the file permissions. See the Kubernetes cluster hardening documentation for more detail.

chmod 644 /var/lib/kubelet/kubeconfig

Note: The path above is the default location in EKS.

References