Ensure Kubeconfig File Permissions Are Set Restrictive

#!/usr/bin/env bash
#
# Purpose: Ensure /etc/kubernetes/kubelet.conf permissions are 644 or more restrictive
# Scope:   Run on every worker node (safe to re-run; idempotent)

set -euo pipefail

KUBECONFIG_PATH="/etc/kubernetes/kubelet.conf"
DESIRED_MODE="644"

echo "=== Kubelet kubeconfig permissions hardening ==="

if [ ! -e "$KUBECONFIG_PATH" ]; then
  echo "File not found: $KUBECONFIG_PATH"
  echo "Nothing to change on this node."
  exit 0
fi

# Get current file mode (numeric, e.g., 600, 644)
CURRENT_MODE="$(stat -c '%a' "$KUBECONFIG_PATH")"

echo "Current permissions on $KUBECONFIG_PATH: $CURRENT_MODE"
echo "Desired minimum permissions: $DESIRED_MODE"

# Normalize to 3-digit modes for comparison
pad_mode() {
  local m="$1"
  printf "%03d" "$m"
}

CMODE="$(pad_mode "$CURRENT_MODE")"
DMODE="$(pad_mode "$DESIRED_MODE")"

# If current mode is already equal or more restrictive than 644, no change.
# "More restrictive" here means:
#   - owner perms <= 6
#   - group perms <= 4
#   - other perms <= 4
# We enforce that, and then set to 644 if it's more permissive than that.
OWNER=${CMODE:0:1}
GROUP=${CMODE:1:1}
OTHER=${CMODE:2:1}

CHANGE_NEEDED=false

# If any class has permissions greater than allowed by 644, we must change.
if [ "$OWNER" -gt "${DMODE:0:1}" ] || \
   [ "$GROUP" -gt "${DMODE:1:1}" ] || \
   [ "$OTHER" -gt "${DMODE:2:1}" ]; then
  CHANGE_NEEDED=true
fi

if ! $CHANGE_NEEDED; then
  echo "Permissions are already 644 or more restrictive. No change required."
else
  echo "Updating permissions on $KUBECONFIG_PATH to $DESIRED_MODE"
  chmod "$DESIRED_MODE" "$KUBECONFIG_PATH"
fi

# Verification (same logic as audit, per node)
echo "=== Verification ==="
/bin/sh -c "if test -e '$KUBECONFIG_PATH'; then stat -c permissions=%a '$KUBECONFIG_PATH'; fi"