Etcd Pod Specification File Ownership Should Be root:root

#!/usr/bin/env bash
#
# Fix ownership of the etcd static pod manifest so it is root:root
# Scope: run on every control plane node (as root)
set -euo pipefail

ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"

echo "==> Checking for etcd manifest at ${ETCD_MANIFEST}"

if [[ ! -e "${ETCD_MANIFEST}" ]]; then
  echo "Etcd manifest not found at ${ETCD_MANIFEST}; nothing to do on this node."
  exit 0
fi

current_owner="$(stat -c '%U:%G' "${ETCD_MANIFEST}")"

echo "Current ownership: ${current_owner}"

if [[ "${current_owner}" != "root:root" ]]; then
  echo "Fixing ownership to root:root"
  chown root:root "${ETCD_MANIFEST}"
else
  echo "Ownership already set to root:root; no change needed."
fi

echo "==> Verifying fix"
stat -c '%U:%G %n' "${ETCD_MANIFEST}"

echo
echo "==> CIS 1.1.8 verification (should output 'root:root'):"
/bin/sh -c 'if test -e /etc/kubernetes/manifests/etcd.yaml; then find /etc/kubernetes/manifests/etcd.yaml -name "*etcd*" | xargs stat -c %U:%G; fi'