Ensure Proxy Kubeconfig File Ownership Is Root

#!/usr/bin/env bash
#
# Remediation: Ensure Proxy Kubeconfig File Ownership Is Root (CIS GKE 3.1.2)
# Target: every worker node
#
# Run this script on each worker node (as root). It is safe to re-run.

set -euo pipefail

KUBEPROXY_KUBECONFIG="/var/lib/kube-proxy/config.conf"

echo "==> Checking for kube-proxy kubeconfig at: ${KUBEPROXY_KUBECONFIG}"

if [ ! -e "${KUBEPROXY_KUBECONFIG}" ]; then
  echo "File not found: ${KUBEPROXY_KUBECONFIG}"
  echo "Nothing to change on this node (kube-proxy may not be running here)."
  exit 0
fi

# Current ownership
current_owner="$(stat -c '%U:%G' "${KUBEPROXY_KUBECONFIG}")"
echo "Current ownership: ${current_owner}"

# Desired ownership is root:root
if [ "${current_owner}" != "root:root" ]; then
  echo "Updating ownership to root:root ..."
  chown root:root "${KUBEPROXY_KUBECONFIG}"
else
  echo "Ownership already set to root:root; no change needed."
fi

# Verification step (adapted from the audit concept, for the correct file)
echo "==> Verifying ownership..."
verify_owner="$(stat -c '%U:%G' "${KUBEPROXY_KUBECONFIG}")"
echo "Verified ownership: ${verify_owner}"

if [ "${verify_owner}" != "root:root" ]; then
  echo "ERROR: Ownership still not root:root on ${KUBEPROXY_KUBECONFIG}" >&2
  exit 1
fi

echo "Remediation successful on this worker node."