Controller Manager Should Enable RotateKubeletServerCertificate

#!/usr/bin/env bash
#
# Purpose: Ensure kube-controller-manager manifest ownership is root:root
# Scope:   Run on every control plane node
# Usage:   sudo ./fix-kcm-manifest-ownership.sh

set -euo pipefail

MANIFEST_PATH="/etc/kubernetes/manifests/kube-controller-manager.yaml"
DESIRED_OWNER="root"
DESIRED_GROUP="root"

echo "==> Checking for kube-controller-manager manifest at ${MANIFEST_PATH}"

if [ ! -e "${MANIFEST_PATH}" ]; then
  echo "Manifest not found at ${MANIFEST_PATH}; nothing to do on this node."
  exit 0
fi

current_owner="$(stat -c %U "${MANIFEST_PATH}")"
current_group="$(stat -c %G "${MANIFEST_PATH}")"
echo "Current ownership: ${current_owner}:${current_group}"

if [ "${current_owner}" = "${DESIRED_OWNER}" ] && [ "${current_group}" = "${DESIRED_GROUP}" ]; then
  echo "Ownership already correct: ${DESIRED_OWNER}:${DESIRED_GROUP}"
else
  echo "Fixing ownership to ${DESIRED_OWNER}:${DESIRED_GROUP}..."
  chown "${DESIRED_OWNER}:${DESIRED_GROUP}" "${MANIFEST_PATH}"
fi

echo "==> Verifying ownership..."

result="$(stat -c %U:%G "${MANIFEST_PATH}")"
echo "Post-fix ownership: ${result}"

if [ "${result}" != "${DESIRED_OWNER}:${DESIRED_GROUP}" ]; then
  echo "ERROR: Ownership is still incorrect. Expected ${DESIRED_OWNER}:${DESIRED_GROUP}, got ${result}" >&2
  exit 1
fi

echo "Ownership successfully set to ${DESIRED_OWNER}:${DESIRED_GROUP} on ${MANIFEST_PATH}"
exit 0