Ensure Kubelet Configuration File Ownership Is Set Root

#!/usr/bin/env bash
#
# Remediation: Ensure kubelet configuration file ownership is set to root:root
# Scope: Run on every worker node (and any control plane node that also runs kubelet)
# Safe to re-run (idempotent)

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"

echo "[-] Checking for kubelet config file at ${KUBELET_CONFIG}"

if ! [ -e "${KUBELET_CONFIG}" ]; then
  echo "[!] File not found: ${KUBELET_CONFIG}  (nothing to do on this node)"
  exit 0
fi

current_owner_group="$(stat -c '%U:%G' "${KUBELET_CONFIG}")"

echo "[-] Current ownership: ${KUBELET_CONFIG} -> ${current_owner_group}"

# Apply remediation only if needed
if [ "${current_owner_group}" != "root:root" ]; then
  echo "[-] Setting ownership to root:root on ${KUBELET_CONFIG}"
  chown root:root "${KUBELET_CONFIG}"
else
  echo "[-] Ownership already correct, no change required"
fi

# Verification step (mirrors the audit command)
verify_owner_group="$(stat -c '%U:%G' "${KUBELET_CONFIG}")"
echo "[-] Post-change ownership: ${KUBELET_CONFIG} -> ${verify_owner_group}"

if [ "${verify_owner_group}" != "root:root" ]; then
  echo "[ERROR] Failed to set ownership to root:root on ${KUBELET_CONFIG}"
  exit 1
fi

echo "[OK] Kubelet configuration file ownership is correctly set to root:root"