Ensure Controller Manager Pod Specification File Permissions Are Restrictive

#!/usr/bin/env bash
#
# Remediation: Ensure kube-controller-manager pod spec file permissions are 644 or more restrictive
# Scope: Run on every control plane node
# Safe to re-run; only adjusts permissions if they are too permissive.

set -euo pipefail

TARGET_FILE="/etc/kubernetes/manifests/kube-controller-manager.yaml"
REQUIRED_MODE="644"

echo "=== kube-controller-manager pod spec permissions remediation ==="

if [ ! -e "${TARGET_FILE}" ]; then
  echo "Target file not found: ${TARGET_FILE}"
  echo "Nothing to remediate on this node."
  exit 0
fi

# Get current numeric permissions (e.g., 640, 644, 600)
current_mode="$(stat -c '%a' "${TARGET_FILE}")"
echo "Current permissions on ${TARGET_FILE}: ${current_mode}"

# Function to compare numeric modes as integers
is_more_permissive() {
  local cur="$1"
  local req="$2"
  # A mode is considered "more permissive" if it's numerically greater (e.g., 660 > 644)
  [ "${cur}" -gt "${req}" ]
}

if is_more_permissive "${current_mode}" "${REQUIRED_MODE}"; then
  echo "Permissions are too permissive. Setting to ${REQUIRED_MODE}..."
  chmod "${REQUIRED_MODE}" "${TARGET_FILE}"
else
  echo "Permissions are already ${REQUIRED_MODE} or more restrictive. No change needed."
fi

# Verification (mirrors the audit command)
echo "Verifying final permissions:"
/bin/sh -c "if test -e ${TARGET_FILE}; then stat -c permissions=%a ${TARGET_FILE}; fi"

echo "Remediation completed on this node."