Ensure Kubelet Configuration File Ownership Is Set To root:root

#!/usr/bin/env bash
#
# Fix kubelet config file ownership on every worker node.
# Usage:
#   1) Put all worker node hostnames/IPs into /root/worker-nodes.txt on a machine
#      that has SSH access to the nodes.
#   2) Run this script from that machine.
#
# Requirements:
#   - Passwordless SSH (or ssh-agent) to each worker node as a user with sudo.
#   - The kubelet config file is at /var/lib/kubelet/config.yaml (per finding).

set -euo pipefail

NODES_FILE="/root/worker-nodes.txt"
REMOTE_CONFIG="/var/lib/kubelet/config.yaml"
SSH_USER="root"        # change to another user (e.g. ec2-user) if needed
SSH_OPTS="-o BatchMode=yes -o StrictHostKeyChecking=no"

if [[ ! -f "${NODES_FILE}" ]]; then
  echo "Nodes file not found: ${NODES_FILE}"
  echo "Create it with one worker node hostname/IP per line."
  exit 1
fi

fix_node() {
  local node="$1"
  echo "=== Processing node: ${node} ==="

  ssh ${SSH_OPTS} "${SSH_USER}@${node}" bash -s <<'EOSSH'
set -euo pipefail
CONFIG="/var/lib/kubelet/config.yaml"

if [[ ! -e "$CONFIG" ]]; then
  echo "  [INFO] $CONFIG does not exist on this node; skipping."
  exit 0
fi

current_owner_group="$(stat -c '%U:%G' "$CONFIG")"

if [[ "$current_owner_group" == "root:root" ]]; then
  echo "  [OK] Ownership already root:root ($current_owner_group). No change needed."
else
  echo "  [INFO] Current ownership: $current_owner_group. Applying chown root:root ..."
  chown root:root "$CONFIG"
fi

# Verification
verified_owner_group="$(stat -c '%U:%G' "$CONFIG")"
if [[ "$verified_owner_group" != "root:root" ]]; then
  echo "  [ERROR] Verification failed, ownership is still $verified_owner_group"
  exit 1
fi

echo "  [OK] Verified ownership is root:root"
EOSSH

  echo
}

while IFS= read -r node; do
  [[ -z "$node" || "$node" =~ ^# ]] && continue
  fix_node "$node"
done < "${NODES_FILE}"

echo "All done."