File /etc/shadow changed on the node. I checked the node audit logs and found that both core and root never had anyone login on the not, yet the file was modified, which is more proof that this is likely cause by something in CoreOS   

Also checked the machine config logs but couldn't find any changes done related to /etc/shadow file.

Customer wants to know exactly wants to know who has changed the file and what exactly changed 

  

 Not able to reproduce the issue   

    1.
    2.
    3.
    

 Unable to determine  the cause what exactly changed the /etc/shadow file 

    Need to know the cause what exactly changed the /etc/shadow file