Ensure Kubelet Kubeconfig File Ownership Is Set Root

#!/usr/bin/env bash
#
# Fix CISEKS 3.1.2: Ensure Kubelet Kubeconfig File Ownership Is Set To root:root
# Target: run on every worker node (as root). Safe to re-run.

set -euo pipefail

KUBELET_KUBECONFIG="/etc/kubernetes/kubelet.conf"

echo "=== CISEKS 3.1.2 remediation on host: $(hostname) ==="

if [ ! -e "$KUBELET_KUBECONFIG" ]; then
  echo "File not found: $KUBELET_KUBECONFIG"
  echo "Nothing to change on this node."
  exit 0
fi

current_owner_group="$(stat -c '%U:%G' "$KUBELET_KUBECONFIG")"

if [ "$current_owner_group" = "root:root" ]; then
  echo "Ownership already correct: $KUBELET_KUBECONFIG -> $current_owner_group"
else
  echo "Current ownership: $KUBELET_KUBECONFIG -> $current_owner_group"
  echo "Setting ownership to root:root ..."
  chown root:root "$KUBELET_KUBECONFIG"
fi

echo "Verifying ownership..."
verified_owner_group="$(stat -c '%U:%G' "$KUBELET_KUBECONFIG")"
echo "Result: $KUBELET_KUBECONFIG -> $verified_owner_group"

if [ "$verified_owner_group" != "root:root" ]; then
  echo "ERROR: Failed to set ownership to root:root on $KUBELET_KUBECONFIG" >&2
  exit 1
fi

echo "Remediation successful on this node."