Ensure Kubelet Configuration File Has Permissions Set Restrictive

#!/usr/bin/env bash
#
# Harden kubelet configuration file permissions on every worker node.
# Target file: /var/lib/kubelet/config.yaml
#
# Usage:
#   1) Copy this script to each worker node (e.g. /root/fix-kubelet-perms.sh)
#   2) Run as root on every worker node:
#        bash /root/fix-kubelet-perms.sh
#   3) Safe to re-run; it is idempotent.

set -euo pipefail

KUBELET_CFG="/var/lib/kubelet/config.yaml"
DESIRED_MODE="644"

echo "=== Kubelet config permission hardening ==="
echo "Target file: ${KUBELET_CFG}"
echo

if [ ! -e "${KUBELET_CFG}" ]; then
  echo "WARNING: ${KUBELET_CFG} does not exist on this node. Nothing to do."
  exit 0
fi

# Show current permissions
current_mode="$(stat -c '%a' "${KUBELET_CFG}")" || {
  echo "ERROR: Failed to read current permissions for ${KUBELET_CFG}"
  exit 1
}

echo "Current permissions: ${current_mode}"

# Apply fix only if needed
if [ "${current_mode}" != "${DESIRED_MODE}" ]; then
  echo "Setting permissions to ${DESIRED_MODE} on ${KUBELET_CFG} ..."
  chmod "${DESIRED_MODE}" "${KUBELET_CFG}"
else
  echo "Permissions already set to ${DESIRED_MODE}; no change needed."
fi

# Verification (mirrors benchmark audit intent)
echo
echo "=== Verifying permissions ==="
verified_mode="$(stat -c 'permissions=%a' "${KUBELET_CFG}")" || {
  echo "ERROR: Verification failed; could not stat ${KUBELET_CFG}"
  exit 1
}
echo "Verification result: ${verified_mode}"

# Parse out numeric mode for comparison
verified_numeric="${verified_mode#permissions=}"

if [ "${verified_numeric}" = "${DESIRED_MODE}" ]; then
  echo "SUCCESS: ${KUBELET_CFG} is now set to ${DESIRED_MODE} as required."
  exit 0
else
  echo "ERROR: Expected permissions ${DESIRED_MODE} but found ${verified_numeric}"
  exit 2
fi