---
title: The kubeconfig file ownership should be assigned to root
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > The kubeconfig file ownership should be
  assigned to root
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# The kubeconfig file ownership should be assigned to root
 
## Description{% #description %}

Kubelet kubeconfig file ownership should be assigned to `root:root` on every EKS worker node. The kubeconfig file (typically located at `/var/lib/kubelet/kubeconfig`) is used by the kubelet to authenticate to the API server, and restricting its ownership to `root` preserves its integrity.

## Remediation{% #remediation %}

Run the below command (based on the file location on your system) on each worker node to set the kubeconfig file ownership to `root:root`. See the [Kubernetes cluster hardening documentation](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/) for more detail.

```bash
chown root:root /var/lib/kubelet/kubeconfig
```

**Note**: The path above is the default location in EKS.

## References{% #references %}

- [Amazon EKS user guide](https://docs.aws.amazon.com/eks/latest/userguide/security.html)
- [CIS Amazon EKS Benchmark](https://www.cisecurity.org/benchmark/kubernetes)