Ensure Kubelet Configuration File Ownership Is Set Root

#!/usr/bin/env bash
#
# Fix CIS OKE 3.1.4:
# Ensure that the kubelet configuration file ownership is set to root:root.
#
# Run this script on every worker node as root.
# It is safe to re-run; it will only adjust ownership if needed.

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"

echo "=== CIS OKE 3.1.4: Kubelet config file ownership to root:root ==="
echo "Target file: ${KUBELET_CONFIG}"
echo

# Check if file exists
if [[ ! -e "${KUBELET_CONFIG}" ]]; then
  echo "File not found: ${KUBELET_CONFIG}"
  echo "No changes made on this node."
  exit 0
fi

# Show current ownership
current_owner_group=$(stat -c '%U:%G' "${KUBELET_CONFIG}")
echo "Current ownership: ${current_owner_group}"

# Change ownership only if needed
if [[ "${current_owner_group}" != "root:root" ]]; then
  echo "Updating ownership to root:root..."
  chown root:root "${KUBELET_CONFIG}"
else
  echo "Ownership already correct; no change needed."
fi

# Verification
echo
echo "Verifying ownership after remediation..."
verified_owner_group=$(stat -c '%U:%G' "${KUBELET_CONFIG}")
echo "Verified ownership: ${verified_owner_group}"

if [[ "${verified_owner_group}" != "root:root" ]]; then
  echo "FAIL: Ownership is not root:root after remediation." >&2
  exit 1
fi

echo "PASS: ${KUBELET_CONFIG} ownership is correctly set to root:root."