Scheduler Pod Specification File Permissions Should Be 600 Or More Restrictive

#!/usr/bin/env bash
# Purpose: Ensure kube-scheduler pod manifest file permissions are 600
# Scope:   Run on every control plane node
# Usage:   sudo /root/fix-kube-scheduler-perms.sh

set -euo pipefail

SCHEDULER_MANIFEST="/etc/kubernetes/manifests/kube-scheduler.yaml"
DESIRED_MODE="600"

echo "==> Checking for kube-scheduler manifest at ${SCHEDULER_MANIFEST}"

if [ ! -e "${SCHEDULER_MANIFEST}" ]; then
  echo "File not found: ${SCHEDULER_MANIFEST}"
  echo "Nothing to change on this node."
  exit 0
fi

# Get current mode (numeric)
CURRENT_MODE="$(stat -c '%a' "${SCHEDULER_MANIFEST}")"

echo "Current permissions: ${CURRENT_MODE}"
echo "Desired permissions: ${DESIRED_MODE}"

if [ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]; then
  echo "Updating permissions to ${DESIRED_MODE} ..."
  chmod "${DESIRED_MODE}" "${SCHEDULER_MANIFEST}"
else
  echo "Permissions already set to ${DESIRED_MODE}; no change needed."
fi

echo "==> Verifying permissions after change"
VERIFY_OUT="$(stat -c 'permissions=%a' "${SCHEDULER_MANIFEST}")"
echo "${VERIFY_OUT}"

if [ "${VERIFY_OUT}" != "permissions=${DESIRED_MODE}" ]; then
  echo "ERROR: Verification failed; expected permissions=${DESIRED_MODE}" >&2
  exit 1
fi

echo "==> Success: kube-scheduler manifest permissions are ${DESIRED_MODE}"
echo "Note: Editing files in /etc/kubernetes/manifests causes the kube-scheduler static pod to be restarted by the kubelet if contents change. A chmod alone should not restart it."