Ensure Kubelet Kubeconfig File Ownership Is Set To root:root

#!/usr/bin/env bash
#
# Automation: Ensure Kubelet kubeconfig file ownership is set to root:root
# Scope: Run on every worker node (as root). Safe to re-run.

set -euo pipefail

KUBELET_KUBECONFIG="/etc/kubernetes/kubelet.conf"

echo "==> Checking for kubelet kubeconfig at ${KUBELET_KUBECONFIG}"

if [ ! -e "${KUBELET_KUBECONFIG}" ]; then
  echo "Kubelet kubeconfig not found at ${KUBELET_KUBECONFIG}, nothing to change on this node."
  exit 0
fi

current_owner="$(stat -c '%U:%G' "${KUBELET_KUBECONFIG}")"

echo "Current ownership: ${current_owner}"

if [ "${current_owner}" != "root:root" ]; then
  echo "Changing ownership to root:root ..."
  chown root:root "${KUBELET_KUBECONFIG}"
else
  echo "Ownership already set to root:root, no change needed."
fi

echo "==> Verifying ownership"

verify_owner="$(stat -c '%U:%G' "${KUBELET_KUBECONFIG}")"
echo "Verified ownership: ${verify_owner}"

if [ "${verify_owner}" != "root:root" ]; then
  echo "ERROR: Failed to set ownership to root:root on ${KUBELET_KUBECONFIG}" >&2
  exit 1
fi

echo "SUCCESS: ${KUBELET_KUBECONFIG} ownership is root:root"