Ensure Kubelet Config File Permissions Are Restrictive

#!/usr/bin/env bash
#
# Purpose: Enforce restrictive permissions (0644) on /var/lib/kubelet/config.yaml
# Scope:   Run on every worker node (and any control plane node that also runs kubelet)
# Usage:   sudo /root/fix-kubelet-config-perms.sh

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
DESIRED_MODE="644"

echo "==> Checking for kubelet config at ${KUBELET_CONFIG}"

if [[ ! -e "${KUBELET_CONFIG}" ]]; then
  echo "Kubelet config file not found at ${KUBELET_CONFIG}; nothing to change on this node."
else
  # Get current permissions (numeric)
  CURRENT_MODE=$(stat -c '%a' "${KUBELET_CONFIG}")

  if [[ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]]; then
    echo "Current permissions ${CURRENT_MODE} on ${KUBELET_CONFIG} are too permissive or incorrect."
    echo "Setting permissions to ${DESIRED_MODE} ..."
    chmod "${DESIRED_MODE}" "${KUBELET_CONFIG}"
  else
    echo "Permissions already set to ${DESIRED_MODE} on ${KUBELET_CONFIG}; no change needed."
  fi

  # Verification (same as audit logic)
  echo "==> Verifying permissions on ${KUBELET_CONFIG}"
  stat -c 'permissions=%a path=%n' "${KUBELET_CONFIG}"
fi

echo "Done."

sudo bash /root/fix-kubelet-config-perms.sh

# Replace the hostnames/IPs with your worker nodes
for NODE in worker1 worker2 worker3; do
  scp fix-kubelet-config-perms.sh "root@${NODE}:/root/"
  ssh "root@${NODE}" "bash /root/fix-kubelet-config-perms.sh"
done