Container Network Interface File Ownership Should Be root:root

#!/usr/bin/env bash
#
# Fix CNI config file ownership to root:root on every control plane node
# Scope: run on every control plane node (as root or with sudo)
# Safe to re-run (idempotent)

set -euo pipefail

echo "=== Detecting CNI configuration directory from kubelet flags (if present) ==="

CNI_CONF_DIRS=()

# Try to detect from running kubelet process
if pgrep -x kubelet >/dev/null 2>&1; then
  # Extract --cni-conf-dir argument if present
  DETECTED_DIRS=$(ps -ef | grep kubelet | grep -v grep \
    | grep -- --cni-conf-dir \
    | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' || true)

  if [ -n "${DETECTED_DIRS}" ]; then
    while IFS= read -r d; do
      [ -n "$d" ] && CNI_CONF_DIRS+=("$d")
    done <<< "${DETECTED_DIRS}"
  fi
fi

# Fallback to common default if none detected
DEFAULT_DIRS=(
  "/etc/cni/net.d"
)
for d in "${DEFAULT_DIRS[@]}"; do
  CNI_CONF_DIRS+=("$d")
done

# De-duplicate directories
uniq_dirs=()
for d in "${CNI_CONF_DIRS[@]}"; do
  skip=false
  for u in "${uniq_dirs[@]}"; do
    if [ "$u" = "$d" ]; then
      skip=true
      break
    fi
  done
  $skip || uniq_dirs+=("$d")
done
CNI_CONF_DIRS=("${uniq_dirs[@]}")

echo "CNI configuration directories to process:"
for d in "${CNI_CONF_DIRS[@]}"; do
  echo " - $d"
done

echo
echo "=== Fixing ownership to root:root where directories exist ==="

for dir in "${CNI_CONF_DIRS[@]}"; do
  if [ -d "$dir" ]; then
    echo "Processing directory: $dir"
    # Change ownership of files and subdirectories to root:root (idempotent)
    chown -R root:root "$dir"
  else
    echo "Directory not present, skipping: $dir"
  fi
done

# Also fix ownership under /var/lib/cni/networks if present (used by audit)
if [ -d "/var/lib/cni/networks" ]; then
  echo "Processing directory: /var/lib/cni/networks"
  chown -R root:root /var/lib/cni/networks
else
  echo "Directory not present, skipping: /var/lib/cni/networks"
fi

echo
echo "=== Verification (should report only root:root) ==="

# Replicate the audit logic to confirm ownership
# 1) CNI config files
if pgrep -x kubelet >/dev/null 2>&1; then
  ps -ef | grep kubelet | grep -v grep | grep -- --cni-conf-dir \
    | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' \
    | xargs -I{} find {} -mindepth 1 2>/dev/null \
    | xargs --no-run-if-empty stat -c '%n %U:%G' \
    | sort -u || true
fi

# Fallback verification for default /etc/cni/net.d
if [ -d "/etc/cni/net.d" ]; then
  find /etc/cni/net.d -mindepth 1 -maxdepth 1 -type f 2>/dev/null \
    | xargs --no-run-if-empty stat -c '%n %U:%G' \
    | sort -u || true
fi

# 2) /var/lib/cni/networks files
if [ -d "/var/lib/cni/networks" ]; then
  find /var/lib/cni/networks -type f 2>/dev/null \
    | xargs --no-run-if-empty stat -c '%n %U:%G' \
    | sort -u || true
fi

echo
echo "If any entries above are not 'root:root', investigate and correct them manually."