<p>I want to set k8s <code>kube-proxy</code> config file permission for hardening purposes.</p>
<p>I'm wordering how the <code>kube-proxy</code> process can be running with the <code>--config</code> flag set to a path (<code>var/lib/kube-proxy/config.conf</code>) that can't be found...</p>
<p>In fact checking <code>kube-proxy</code> process gives this :</p>
<pre><code>[centos@cpu-node0 ~]$ ps -ef | grep kube-proxy
root     20890 20872  0 Oct20 ?        00:19:23 /usr/local/bin/kube-proxy --config=/var/lib/kube-proxy/config.conf --hostname-override=cpu-node0
centos   55623 51112  0 14:44 pts/0    00:00:00 grep --color=auto kube-proxy
</code></pre>
<p>But the file <code>/var/lib/kube-proxy/config.conf</code> does not exist :</p>
<pre><code>[centos@cpu-node0 ~]$ ll /var/lib/kube-proxy/config.conf
ls: cannot access /var/lib/kube-proxy/config.conf: No such file or directory
</code></pre>
<p>Why?</p>

<p>I am also facing issue on my setup ( 1.19)</p>
<pre><code>[root@project1kubemaster ~]# kubectl version --short
Client Version: v1.19.3
Server Version: v1.19.3

[root@project1kubemaster ~]# ps -ef | grep kube-proxy
root      2103  2046  0 11:30 ?        00:00:00 /usr/local/bin/kube-proxy --config=/var/lib/kube-proxy/config.conf --hostname-override=project1kubemaster

[root@project1kubemaster ~]# ll /var/lib/kube-proxy/config.conf
ls: cannot access /var/lib/kube-proxy/config.conf: No such file or directory

</code></pre>
<p>One more interesting thing is &quot;kube-proxy&quot; is also not found :</p>
<pre><code>[root@project1kubemaster ~]# ls /usr/local/bin/kube-proxy
ls: cannot access /usr/local/bin/kube-proxy: No such file or directory
</code></pre>
<p>Above made me realize that kube-proxy binary is running inside kubeproxy container of that node</p>
<pre><code>[root@project1kubemaster ~]# kubectl get pods -n kube-system -o wide | grep proxy
kube-proxy-ffbqr                             1/1     Running   0          27m   &lt;IP&gt;   project1kubeworker2   &lt;none&gt;           &lt;none&gt;
kube-proxy-r9pz9                             1/1     Running   0          29m   &lt;IP&gt;  project1kubemaster    &lt;none&gt;           &lt;none&gt;
kube-proxy-zcrtw                             1/1     Running   0          27m   &lt;IP&gt;   project1kubeworker1   &lt;none&gt;           &lt;none&gt;

[root@project1kubemaster ~]# kubectl exec -it kube-proxy-r9pz9 -n kube-system -- /bin/sh
#
#
# find / -name config.conf
/var/lib/kube-proxy/..2020_11_02_16_30_32.787002112/config.conf
/var/lib/kube-proxy/config.conf

</code></pre>
<p>In short , It seems like kube-proxy binary &amp; config files are inside kube-proxy pod of that node and they are running inside that pod . One reason why it might show up ps -ef output of host can be due to that pod is using Pid Name space of the host . also we can see that parent pid of kube-proxy process is nothing but containerd of that respective container .</p>
<pre><code>[root@project1kubemaster ~]# ps -ef | grep 2046
root      2046 16904  0 11:30 ?        00:00:00 containerd-shim -namespace moby -workdir /var/lib/containerd/io.containerd.runtime.v1.linux/moby/c3e9bf6ecdcdd0f56d0c76711cea4cadd023cd6ef82bf8312311248a7b0501a4 -address /run/containerd/containerd.sock -containerd-binary /usr/bin/containerd -runtime-root /var/run/docker/runtime-runc
root      2103  2046  0 11:30 ?        00:00:00 /usr/local/bin/kube-proxy --config=/var/lib/kube-proxy/config.conf --hostname-override=project1kubemaster
</code></pre>
