Ensure Kubelet Configuration File Ownership Is Set To Root

#!/usr/bin/env bash
#
# Remediate CIS GKE 3.1.4 on every worker node:
# Ensure /etc/kubernetes/kubelet-config.yaml is owned by root:root
#
# Run this script on each worker node (e.g. via SSH, Ansible shell, or your CM tool).

set -euo pipefail

CONFIG_FILE="/etc/kubernetes/kubelet-config.yaml"

echo "=== CIS GKE 3.1.4: Ensure kubelet configuration file ownership is set to root:root ==="

if [ ! -e "$CONFIG_FILE" ]; then
  echo "File not found: $CONFIG_FILE"
  echo "Nothing to change on this node."
else
  current_owner_group="$(stat -c '%U:%G' "$CONFIG_FILE")"
  echo "Current ownership: $CONFIG_FILE -> $current_owner_group"

  if [ "$current_owner_group" != "root:root" ]; then
    echo "Updating ownership to root:root ..."
    chown root:root "$CONFIG_FILE"
  else
    echo "Ownership already set to root:root, no change needed."
  fi

  echo "Verifying ownership ..."
  verify_owner_group="$(stat -c '%U:%G' "$CONFIG_FILE")"
  echo "Post-change ownership: $CONFIG_FILE -> $verify_owner_group"

  if [ "$verify_owner_group" != "root:root" ]; then
    echo "ERROR: Failed to set ownership to root:root for $CONFIG_FILE" >&2
    exit 1
  fi

  echo "SUCCESS: $CONFIG_FILE ownership is correctly set to root:root"
fi