# Cis Ocp V170 4.1.1

> Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated)

- Skill: `cyberstrikeus/cis-ocp-v170-4-1-1` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-ocp-v170-4-1-1`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-ocp-v170-4-1-1/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-ocp-v170-4-1-1

---


# CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 4.1.1

## Profile Applicability

- **Level:** 1

## Description

Ensure that the kubelet service file has permissions of `644` or more restrictive.

## Rationale

The kubelet service file controls various parameters that set the behavior of the kubelet service in the worker node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.

## Impact

None

## Audit Procedure

Kubelet is run as a `systemd` unit and its configuration file is created with `644` permissions.

Run the following command:

```bash
for node in $(oc get nodes -o jsonpath='{.items[*].metadata.name}')
do
  oc debug node/${node} -- chroot /host stat -c %a /etc/systemd/system/kubelet.service
done
```

Verify that the permissions are `644` or more restrictive.

## Remediation

None.

## Default Value

By default, the kubelet service file has permissions of `644`.

## References

1. https://docs.openshift.com/container-platform/4.5/architecture/control-plane.html#understanding-machine-config-operator_control-plane
2. https://docs.openshift.com/container-platform/4.5/scalability_and_performance/recommended-host-practices.html#create-a-kubeletconfig-crd-to-edit-kubelet-parameters_
3. https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/
4. https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/#44-joining-your-nodes
5. https://kubernetes.io/docs/reference/setup-tools/kubeadm/#kubelet-drop-in

## CIS Controls

| Controls Version | Control                                               | IG 1 | IG 2 | IG 3 |
| ---------------- | ----------------------------------------------------- | ---- | ---- | ---- |
| v8               | 3.3 Configure Data Access Control Lists               | \*   | \*   | \*   |
| v7               | 14.6 Protect Information through Access Control Lists | \*   | \*   | \*   |

## MITRE ATT&CK Mappings

| Techniques / Sub-techniques | Tactics        | Mitigations |
| --------------------------- | -------------- | ----------- |
| T1083, T1222                | TA0005, TA0007 | M1022       |

## Profile

**Level 1** (Automated)