Azure Kubernetes Service (AKS): How to validate if the kubeconfig file has permissions set to 644 or more restrictive?

Question

I am looking into validating the kubeconfig file permissions in AKS.

I used these commands to check the permissions:

*sudo systemctl status kubelet

The output should return `Active: active (running) since..`

Run the following command on each node to find the appropriate Kubelet config file:

ps -ef | grep kubelet

The output of the above command should return something similar to `--config /etc/kubernetes/kubelet/kubelet-config.json` which is the location of the Kubelet config file.

Run the following command:

stat -c %a /etc/kubernetes/kubelet/kubelet-config.json*

The output returned is that the root has permissions. Does that mean the permissions are set to 644 or more restrictive?

Answer 1

To validate the permissions of your kubeconfig file in an AKS environment, you don't need to check the kubelet service or the kubelet config on the nodes themselves, because AKS nodes are managed by Azure and typically don't provide access for such operations. Instead, you check the permissions of the kubeconfig file on your local machine, which is used by kubectl to interact with your AKS cluster.

You can validate the permissions of your kubeconfig file on your local system. By default, the kubeconfig file is located at ~/.kube/config on your local system.

ls -l ~/.kube/config

If you have specified a different path for your kubeconfig file, you will need to check that path instead.

The command which you used, i.e. ps -ef | grep kubelet is intended to display the processes currently running that match the keyword "kubelet".

Alternatively, you can use to check permission-

stat -c %a ~/.kube/config

In this case, a permission of 600 is more restrictive than 644 because it only allows the owner to read and write the file, with no permissions granted to group and others. The permissions 644 would allow read and write to the owner and read-only access to group and others. Therefore, the permissions set on your kubeconfig file are indeed more restrictive than 644, which is a secure setting for this sensitive file.