Client Certificate Authorities File Ownership Set To root:root

#!/usr/bin/env bash
#
# Fix ownership of kubelet client CA file (CIS Kubernetes 4.1.8)
# Scope: run on every worker node (can be run on control planes as well; it is safe)
# Idempotent: yes

set -euo pipefail

echo "[INFO] Detecting kubelet --client-ca-file path (if specified)..."

# Try to detect the client CA file from kubelet process args
CAFILE="$(ps -ef \
  | grep kubelet \
  | grep -v apiserver \
  | grep -- '--client-ca-file=' \
  | awk -F '--client-ca-file=' '{print $2}' \
  | awk '{print $1}' \
  | uniq || true)"

# Fall back to default if not set
if [ -z "${CAFILE}" ]; then
  CAFILE="/etc/kubernetes/pki/ca.crt"
  echo "[INFO] --client-ca-file flag not found, using default: ${CAFILE}"
else
  echo "[INFO] Detected --client-ca-file: ${CAFILE}"
fi

# Ensure the file exists
if [ ! -e "${CAFILE}" ]; then
  echo "[WARN] Client CA file does not exist: ${CAFILE}"
  echo "[WARN] Nothing to change on this node."
  exit 0
fi

echo "[INFO] Current ownership of ${CAFILE}:"
stat -c '%n %U:%G %a' "${CAFILE}"

# Apply required ownership (idempotent)
echo "[INFO] Setting ownership of ${CAFILE} to root:root ..."
chown root:root "${CAFILE}"

echo "[INFO] Ownership updated. Verifying..."

OWNER_GROUP="$(stat -c '%U:%G' "${CAFILE}")"
echo "[INFO] Post-change ownership of ${CAFILE}: ${OWNER_GROUP}"

if [ "${OWNER_GROUP}" != "root:root" ]; then
  echo "[ERROR] Failed to set ownership of ${CAFILE} to root:root"
  exit 1
fi

echo "[INFO] Verification passed: ${CAFILE} is owned by root:root"

# Re-run the benchmark audit logic for explicit confirmation
echo "[INFO] Running audit-style verification..."

CAFILE_AUDIT="$(ps -ef \
  | grep kubelet \
  | grep -v apiserver \
  | grep -- '--client-ca-file=' \
  | awk -F '--client-ca-file=' '{print $2}' \
  | awk '{print $1}' \
  | uniq || true)"

if [ -z "${CAFILE_AUDIT}" ]; then
  CAFILE_AUDIT="/etc/kubernetes/pki/ca.crt"
fi

if [ -e "${CAFILE_AUDIT}" ]; then
  echo -n "[INFO] Audit ownership for ${CAFILE_AUDIT}: "
  stat -c '%U:%G' "${CAFILE_AUDIT}"
else
  echo "[WARN] Audit path ${CAFILE_AUDIT} does not exist."
fi

echo "[INFO] Completed ownership remediation on this node."

ssh <worker-node> 'bash -s' < fix_client_ca_ownership.sh