Ensure Admin Configuration File Permissions Are 600

#!/usr/bin/env bash
#
# Purpose: Ensure /etc/kubernetes/admin.conf has permissions 600
# Scope:   Run on every control plane node (as root)
# Usage:   sudo bash ./fix-admin-conf-perms.sh

set -euo pipefail

ADMIN_CONF="/etc/kubernetes/admin.conf"
DESIRED_PERMS="600"

echo "=== Ensuring permissions on ${ADMIN_CONF} are ${DESIRED_PERMS} ==="

# Check if file exists; if not, nothing to do on this node
if [ ! -e "${ADMIN_CONF}" ]; then
  echo "File ${ADMIN_CONF} does not exist on this node. Skipping."
  exit 0
fi

# Get current permissions (numeric, e.g. 644)
current_perms="$(stat -c '%a' "${ADMIN_CONF}")"
echo "Current permissions: ${current_perms}"

# Apply fix only if needed (idempotent)
if [ "${current_perms}" != "${DESIRED_PERMS}" ]; then
  echo "Updating permissions to ${DESIRED_PERMS}..."
  chmod "${DESIRED_PERMS}" "${ADMIN_CONF}"
else
  echo "Permissions already set to ${DESIRED_PERMS}. No change needed."
fi

# Verification (same logic as audit command, with explicit check)
echo "Verifying final permissions..."
final_perms="$(stat -c 'permissions=%a' "${ADMIN_CONF}")"
echo "${final_perms}"

if [ "${final_perms}" = "permissions=${DESIRED_PERMS}" ]; then
  echo "SUCCESS: ${ADMIN_CONF} permissions are correctly set to ${DESIRED_PERMS}."
  exit 0
else
  echo "ERROR: Expected permissions=${DESIRED_PERMS}, but found ${final_perms}."
  exit 1
fi