Ensure Kubeconfig Kubelet Conf File Ownership Is Root

#!/usr/bin/env bash
#
# Automation: Ensure /etc/kubernetes/kubelet.conf is owned by root:root
# Scope: Run on every worker node
# Safe to re-run; only adjusts ownership if needed.

set -euo pipefail

KUBELET_CONF="/etc/kubernetes/kubelet.conf"

echo "=== [INFO] Checking for ${KUBELET_CONF} ==="
if [[ ! -e "${KUBELET_CONF}" ]]; then
  echo "=== [WARN] ${KUBELET_CONF} not found on this node, nothing to do."
  exit 0
fi

current_owner_group="$(stat -c '%U:%G' "${KUBELET_CONF}")"
echo "=== [INFO] Current ownership: ${current_owner_group}"

if [[ "${current_owner_group}" != "root:root" ]]; then
  echo "=== [INFO] Changing ownership to root:root"
  chown root:root "${KUBELET_CONF}"
else
  echo "=== [INFO] Ownership already root:root, no change needed."
fi

echo "=== [INFO] Verifying remediation ==="
/bin/sh -c 'if test -e /etc/kubernetes/kubelet.conf; then stat -c %U:%G /etc/kubernetes/kubelet.conf; fi'

verified_owner_group="$(stat -c '%U:%G' "${KUBELET_CONF}")"
if [[ "${verified_owner_group}" != "root:root" ]]; then
  echo "=== [ERROR] Verification failed: expected root:root, got ${verified_owner_group}"
  exit 1
fi

echo "=== [OK] kubelet.conf ownership is correctly set to root:root ==="