Kubernetes PKI Key File Permissions Should Be 600

#!/usr/bin/env bash
#
# Harden Kubernetes PKI private key permissions on all control plane nodes.
# Target: run on every control plane node (as root or with sudo).
# Idempotent: safe to run multiple times.

set -euo pipefail

PKI_DIR="/etc/kubernetes/pki"
KEY_GLOB="${PKI_DIR}/*.key"

echo "==> Ensuring Kubernetes PKI key file permissions are 600 under ${PKI_DIR}"

if [ ! -d "${PKI_DIR}" ]; then
  echo "PKI directory ${PKI_DIR} does not exist on this node; nothing to do."
  exit 0
fi

# Find all .key files (if none, exit cleanly)
mapfile -t KEY_FILES < <(find "${PKI_DIR}" -maxdepth 1 -type f -name '*.key' 2>/dev/null || true)

if [ "${#KEY_FILES[@]}" -eq 0 ]; then
  echo "No *.key files found in ${PKI_DIR}; nothing to do."
  exit 0
fi

echo "Found ${#KEY_FILES[@]} key file(s):"
printf '  %s\n' "${KEY_FILES[@]}"

# Apply permissions 600 to each key file (idempotent)
for key_file in "${KEY_FILES[@]}"; do
  if [ ! -f "${key_file}" ]; then
    continue
  fi
  current_perm=$(stat -c '%a' "${key_file}")
  if [ "${current_perm}" != "600" ]; then
    echo "  Setting permissions 600 on ${key_file} (was ${current_perm})"
    chmod 600 "${key_file}"
  else
    echo "  Permissions already 600 on ${key_file}; skipping"
  fi
done

echo
echo "==> Verification (should show permissions=600 for each .key file)"
find "${PKI_DIR}/" -name '*.key' | xargs stat -c 'permissions=%a %n' || true