API Server Pod Specification File Permissions Should Be 600 Or More Restrictive

#!/usr/bin/env bash
#
# Harden kube-apiserver pod manifest permissions on all control plane nodes.
# Run this script on each control plane node (e.g., via SSH or Ansible shell module).
#
# Requirements:
#   - Run as root (or with sudo) on the control plane node.

set -euo pipefail

MANIFEST_PATH="/etc/kubernetes/manifests/kube-apiserver.yaml"
REQUIRED_MODE="600"

echo "==> Checking for kube-apiserver manifest at ${MANIFEST_PATH}"

if [ ! -e "${MANIFEST_PATH}" ]; then
  echo "WARNING: ${MANIFEST_PATH} does not exist on this node. Skipping."
  exit 0
fi

current_mode="$(stat -c '%a' "${MANIFEST_PATH}")"
echo "Current permissions: ${current_mode}"

# Normalize modes to 3 digits for comparison
pad_mode() {
  local m="$1"
  printf "%03d" "${m}"
}

current_mode_padded="$(pad_mode "${current_mode}")"
required_mode_padded="$(pad_mode "${REQUIRED_MODE}")"

# Convert octal modes to decimal to compare "restrictiveness"
octal_to_decimal() {
  local o="$1"
  echo "ibase=8; ${o}" | bc
}

current_dec="$(octal_to_decimal "${current_mode_padded}")"
required_dec="$(octal_to_decimal "${required_mode_padded}")"

# If current mode is numerically greater (less restrictive) than required, update it.
if [ "${current_dec}" -gt "${required_dec}" ]; then
  echo "Permissions are too permissive; setting to ${REQUIRED_MODE}"
  chmod "${REQUIRED_MODE}" "${MANIFEST_PATH}"
else
  # Even if already restrictive (e.g., 400), we leave as is for idempotency.
  echo "Permissions are already ${current_mode} which is as restrictive or more restrictive than ${REQUIRED_MODE}; no change needed."
fi

echo "==> Verifying final permissions:"
/bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-apiserver.yaml; then stat -c permissions=%a /etc/kubernetes/manifests/kube-apiserver.yaml; fi'