From a7391a14616ee57db9ee25dcd374e72596463c22 Mon Sep 17 00:00:00 2001
From: Shaleen Bathla <shaleen.bathla@servicenow.com>
Date: Thu, 6 Aug 2026 18:52:55 +0530
Subject: [PATCH] kubelet, crio service: standardize unit file permissions to
 0644 (#13408)

* kubelet.service: use standard permissions

systemd[1]: Configuration file /etc/systemd/system/kubelet.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.

* crio.service: reduce execute permission

systemd[1]: Configuration file /etc/systemd/system/crio.service is marked executable. Please remove executable permission bits. Proceeding anyway.
---
 roles/container-engine/cri-o/tasks/main.yaml | 2 +-
 roles/kubernetes/node/tasks/kubelet.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/container-engine/cri-o/tasks/main.yaml b/roles/container-engine/cri-o/tasks/main.yaml
index 3ed03f001..b27245c12 100644
--- a/roles/container-engine/cri-o/tasks/main.yaml
+++ b/roles/container-engine/cri-o/tasks/main.yaml
@@ -150,7 +150,7 @@
   copy:
     src: "{{ local_release_dir }}/cri-o/contrib/crio.service"
     dest: /etc/systemd/system/crio.service
-    mode: "0755"
+    mode: "0644"
     remote_src: true
   notify: Restart crio
 
diff --git a/roles/kubernetes/node/tasks/kubelet.yml b/roles/kubernetes/node/tasks/kubelet.yml
index 1f27bd072..035feb48c 100644
--- a/roles/kubernetes/node/tasks/kubelet.yml
+++ b/roles/kubernetes/node/tasks/kubelet.yml
@@ -33,7 +33,7 @@
     src: "kubelet.service.j2"
     dest: "/etc/systemd/system/kubelet.service"
     backup: true
-    mode: "0600"
+    mode: "0644"
     validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:kubelet.service'"
     # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
     # Remove once we drop support for systemd < 250