Ensure Kubernetes PKI Key File Permissions Are 600

#!/usr/bin/env bash
#
# Remediation: Ensure Kubernetes PKI key files have permissions of 600
# Scope: Run on every control plane node
# Safe to re-run (idempotent)

set -euo pipefail

PKI_DIR="/etc/kubernetes/pki"

echo "==> Ensuring PKI directory exists: ${PKI_DIR}"
if [[ ! -d "${PKI_DIR}" ]]; then
  echo "PKI directory ${PKI_DIR} does not exist on this node. Nothing to do."
  exit 0
fi

echo "==> Finding Kubernetes PKI key files under ${PKI_DIR}"
mapfile -t KEY_FILES < <(find "${PKI_DIR}" -type f -name '*.key' 2>/dev/null || true)

if [[ ${#KEY_FILES[@]} -eq 0 ]]; then
  echo "No .key files found under ${PKI_DIR}. Nothing to do."
  exit 0
fi

echo "==> Adjusting permissions to 600 on all Kubernetes PKI key files"
for key_file in "${KEY_FILES[@]}"; do
  # Only change if not already 600
  current_perm=$(stat -c "%a" "${key_file}")
  if [[ "${current_perm}" != "600" ]]; then
    echo "  - Setting ${key_file} from ${current_perm} to 600"
    chmod 600 "${key_file}"
  else
    echo "  - ${key_file} already has permission 600"
  fi
done

echo "==> Verification: checking resulting permissions"
find "${PKI_DIR}" -name '*.key' | xargs stat -c 'permissions=%a %n'

echo "==> Completed. All Kubernetes PKI key files under ${PKI_DIR} should now be 600."