For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/default_rules/def-000-5nt.md. A documentation index is available at /llms.txt.

An EKS Cluster's kubelet configuration file ownership should be assigned to root

eks

Description

EKS worker nodes that reference a kubelet configuration file with the --config argument should set the file ownership to root:root to maintain its integrity. Identify the file location reported by ps -efww | grep kubelet | grep -- '--config' (commonly /etc/kubernetes/kubelet/config.json) and verify its ownership.

Remediation

Using the config file location identified in the audit step, run the following command to set the kubelet configuration file ownership to root. See the Amazon EKS security best practices for more details.

chown root:root /etc/kubernetes/kubelet/config.json

References