Proxy Kubeconfig File Permissions Set To 600 Or More Restrictive

#!/usr/bin/env bash
#
# Fix: Ensure /etc/kubernetes/proxy.conf has permissions 600 or more restrictive
# Scope: Run on every worker node (as root). Safe to re-run.

set -euo pipefail

PROXY_CONF="/etc/kubernetes/proxy.conf"

echo "==> Checking for ${PROXY_CONF}"

if [ ! -e "${PROXY_CONF}" ]; then
  echo "File ${PROXY_CONF} does not exist on this node. Nothing to do."
  exit 0
fi

# Show current permissions
current_perm="$(stat -c '%a' "${PROXY_CONF}")"
echo "Current permissions: ${current_perm}"

# Apply restrictive permissions (idempotent)
echo "Setting permissions to 600 on ${PROXY_CONF}"
chmod 600 "${PROXY_CONF}"

# Verify
echo "Verifying final permissions..."
final_perm="$(stat -c '%a' "${PROXY_CONF}")"
echo "Final permissions: ${final_perm}"

if [ "${final_perm}" -le 600 ]; then
  echo "SUCCESS: ${PROXY_CONF} permissions are ${final_perm}, which is 600 or more restrictive."
  # Re-run of the benchmark audit equivalent
  echo "Audit output:"
  /bin/sh -c "if test -e ${PROXY_CONF}; then stat -c permissions=%a ${PROXY_CONF}; fi"
  exit 0
else
  echo "ERROR: ${PROXY_CONF} permissions are ${final_perm}, which is NOT 600 or more restrictive."
  exit 1
fi