How do I install the Cis K8S V1120 4.1.1 skill?

Run npx skillmds@latest add cyberstrikeus/cis-k8s-v1120-4-1-1 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Cis K8S V1120 4.1.1 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis K8S V1120 4.1.1?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis K8S V1120 4.1.1 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis K8S V1120 4.1.1?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis K8S V1120 4.1.1 by cyberstrikeus

Name: Cis K8S V1120 4.1.1
Author: cyberstrikeus

File contents

CIS Kubernetes Benchmark v1.12.0 - Control 4.1.1

Description

Ensure that the kubelet service file has permissions of 600 or more restrictive.

Rationale

The kubelet service file controls various parameters that set the behavior of the kubelet service in the worker node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.

Impact

None

Audit Procedure

Step 1: Set the kubelet service config variable

Automated AAC auditing has been modified to allow CIS-CAT to input a variable for the <PATH>/<FILENAME> of the kubelet service config file.

Please set $kubelet_service_config=<PATH> based on the file location on your system.

For example:

export kubelet_service_config=/etc/systemd/system/kubelet.service.d/kubeadm.conf

Step 2: Verify file permissions

To perform the audit manually: Run the below command (based on the file location on your system) on the each worker node. For example,

stat -c %a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

Verify that the permissions are 600 or more restrictive.

Remediation

Run the below command (based on the file location on your system) on the each worker node. For example,

chmod 600 /etc/systemd/system/kubelet.service.d/kubeadm.conf

Default Value

By default, the kubelet service file has permissions of 640.

References

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	3.3 Configure Data Access Control ListsConfigure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.		●	●
v7	14.6 Protect Information through Access Control ListsProtect all information stored on systems with file system, network share, claims, application, or database specific access control lists.	●	●	●

Profile Applicability

Level 1 - Master Node

Assessment Status

Automated

---name: cis-k8s-v1120-4-1-1description: Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)---# CIS Kubernetes Benchmark v1.12.0 - Control 4.1.1## DescriptionEnsure that the `kubelet` service file has permissions of `600` or more restrictive.## RationaleThe `kubelet` service file controls various parameters that set the behavior of the `kubelet` service in the worker node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.## ImpactNone## Audit Procedure### Step 1: Set the kubelet service config variableAutomated AAC auditing has been modified to allow CIS-CAT to input a variable for the `<PATH>/<FILENAME>` of the kubelet service config file.Please set `$kubelet_service_config=<PATH>` based on the file location on your system.For example:```bashexport kubelet_service_config=/etc/systemd/system/kubelet.service.d/kubeadm.conf```### Step 2: Verify file permissionsTo perform the audit manually: Run the below command (based on the file location on your system) on the each worker node. For example,```bashstat -c %a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf```Verify that the permissions are `600` or more restrictive.## RemediationRun the below command (based on the file location on your system) on the each worker node. For example,```bashchmod 600 /etc/systemd/system/kubelet.service.d/kubeadm.conf```## Default ValueBy default, the `kubelet` service file has permissions of `640`.## References1. https://kubernetes.io/docs/admin/kubelet/2. https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/#44-joining-your-nodes3. https://kubernetes.io/docs/admin/kubeadm/#kubelet-drop-in## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---- | ---- | ---- || v8 | 3.3 Configure Data Access Control Lists<br>Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications. | | ● | ● || v7 | 14.6 Protect Information through Access Control Lists<br>Protect all information stored on systems with file system, network share, claims, application, or database specific access control lists. | ● | ● | ● |## Profile Applicability- Level 1 - Master Node## Assessment StatusAutomated

Frequently asked questions

Cis K8S V1120 4.1.1