Ensure Controller Manager Pod Specification File Ownership Is Root

#!/usr/bin/env bash
#
# Automation: Ensure kube-controller-manager pod spec file is owned by root:root
# Scope: Run on every control plane node
# Usage: sudo ./fix-kcm-ownership.sh

set -euo pipefail

KCM_MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml"
REQUIRED_OWNER="root"
REQUIRED_GROUP="root"

echo "=== Checking kube-controller-manager manifest ownership on this node ==="

if [ ! -e "$KCM_MANIFEST" ]; then
  echo "INFO: $KCM_MANIFEST does not exist on this node. Nothing to do."
  exit 0
fi

current_owner="$(stat -c %U "$KCM_MANIFEST")"
current_group="$(stat -c %G "$KCM_MANIFEST")"

echo "Current ownership: $current_owner:$current_group"
echo "Required ownership: $REQUIRED_OWNER:$REQUIRED_GROUP"

if [ "$current_owner" = "$REQUIRED_OWNER" ] && [ "$current_group" = "$REQUIRED_GROUP" ]; then
  echo "Ownership already correct. No changes needed."
else
  echo "Fixing ownership..."
  chown "${REQUIRED_OWNER}:${REQUIRED_GROUP}" "$KCM_MANIFEST"
fi

echo "=== Verifying ownership ==="
stat -c %U:%G "$KCM_MANIFEST"

if [ "$(stat -c %U "$KCM_MANIFEST")" = "$REQUIRED_OWNER" ] && \
   [ "$(stat -c %G "$KCM_MANIFEST")" = "$REQUIRED_GROUP" ]; then
  echo "SUCCESS: $KCM_MANIFEST is owned by ${REQUIRED_OWNER}:${REQUIRED_GROUP}"
  exit 0
else
  echo "ERROR: Failed to enforce ownership on $KCM_MANIFEST" >&2
  exit 1
fi