Ensure Kubelet Service File Ownership Is Root

#!/usr/bin/env bash
# Purpose: Ensure kubelet service file ownership is root:root on all worker nodes
# Target:  Every worker node (run this script on each worker node, as root)
# Safe:    Idempotent; re-running will keep ownership at root:root

set -euo pipefail

KUBELET_UNIT_DIR="/etc/systemd/system/kubelet.service.d"
KUBELET_UNIT_FILE="${KUBELET_UNIT_DIR}/10-kubeadm.conf"

echo "==> Checking for kubelet service drop-in: ${KUBELET_UNIT_FILE}"

if [[ ! -e "${KUBELET_UNIT_FILE}" ]]; then
  echo "File not found: ${KUBELET_UNIT_FILE}"
  echo "No changes made on this node."
  exit 0
fi

# Show current ownership
current_owner_group="$(stat -c '%U:%G' "${KUBELET_UNIT_FILE}")"
echo "Current ownership: ${current_owner_group}"

# Change ownership only if needed
if [[ "${current_owner_group}" != "root:root" ]]; then
  echo "Updating ownership to root:root ..."
  chown root:root "${KUBELET_UNIT_FILE}"
else
  echo "Ownership already root:root, no change needed."
fi

# Verification (same logic as audit command)
echo "==> Verifying ownership..."
verified_owner_group="$(stat -c '%U:%G' "${KUBELET_UNIT_FILE}")"
echo "Verified ownership: ${verified_owner_group}"

if [[ "${verified_owner_group}" != "root:root" ]]; then
  echo "ERROR: Ownership is not root:root after remediation." >&2
  exit 1
fi

echo "Remediation successful on this node."