Ensure Kubelet Configuration File Ownership Is Set To root:root

#!/usr/bin/env bash
#
# Fix CIS GKE 3.1.4: Ensure Kubelet Configuration File Ownership Is Set To root:root
#
# Run on: every worker node (as root)
# Safe to re-run: yes

set -euo pipefail

CONFIG_FILE="/etc/kubernetes/kubelet-config.yaml"
TARGET_OWNER="root"
TARGET_GROUP="root"

echo "==> CIS GKE 3.1.4 remediation on host: ${HOSTNAME}"

if [ ! -e "${CONFIG_FILE}" ]; then
  echo "Config file not found at ${CONFIG_FILE}; nothing to change on this node."
  exit 0
fi

echo "Current ownership:"
stat -c '  %n -> %U:%G' "${CONFIG_FILE}"

# Apply fix
echo "Setting ownership to ${TARGET_OWNER}:${TARGET_GROUP}..."
chown "${TARGET_OWNER}:${TARGET_GROUP}" "${CONFIG_FILE}"

# Verification (adapted from audit command)
echo "Verifying ownership..."
OWNERSHIP="$(stat -c %U:%G "${CONFIG_FILE}")"

if [ "${OWNERSHIP}" = "${TARGET_OWNER}:${TARGET_GROUP}" ]; then
  echo "PASS: ${CONFIG_FILE} ownership is ${OWNERSHIP}"
  exit 0
else
  echo "FAIL: ${CONFIG_FILE} ownership is ${OWNERSHIP}, expected ${TARGET_OWNER}:${TARGET_GROUP}" >&2
  exit 1
fi