Ensure Kubelet Configuration File Should Have Permissions Set Restrictive

#!/usr/bin/env bash
#
# Purpose: Ensure kubelet config file permissions are set to 644 or more restrictive.
# Scope  : Run on every worker node (and any control-plane nodes that also run kubelet).
# Usage  : sudo /path/to/script.sh

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
DESIRED_MODE="644"
CHANGED=0

echo "==> Checking kubelet config permissions on this node"

if [ ! -e "${KUBELET_CONFIG}" ]; then
  echo "Kubelet config file not found at ${KUBELET_CONFIG}; nothing to change on this node."
else
  current_mode="$(stat -c '%a' "${KUBELET_CONFIG}")"
  echo "Current mode for ${KUBELET_CONFIG}: ${current_mode}"

  # Only relax permissions if needed; chmod is idempotent even if already 644
  if [ "${current_mode}" != "${DESIRED_MODE}" ]; then
    echo "Updating permissions to ${DESIRED_MODE} on ${KUBELET_CONFIG}"
    chmod "${DESIRED_MODE}" "${KUBELET_CONFIG}"
    CHANGED=1
  else
    echo "Permissions already set to ${DESIRED_MODE}; no change needed."
  fi
fi

echo
echo "==> Verifying result"

if [ -e "${KUBELET_CONFIG}" ]; then
  stat -c 'permissions=%a path=%n' "${KUBELET_CONFIG}"
else
  echo "Kubelet config file still not present at ${KUBELET_CONFIG}; verify kubelet configuration on this node."
fi

if [ "${CHANGED}" -eq 1 ]; then
  echo "Permissions were updated on this node."
else
  echo "No permission changes were required on this node."
fi