Ensure Kubelet Configuration File Permissions Are 644 Or More Restrictive

#!/usr/bin/env bash
#
# Purpose: Ensure kubelet configuration file permissions are 0644 or more restrictive
# Scope:   Run on every worker node (and any control-plane nodes that also run kubelet)
# Usage:   sudo /usr/local/sbin/fix-kubelet-config-perms.sh

set -euo pipefail

CONFIG_FILE="/var/lib/kubelet/config.yaml"
DESIRED_MODE="644"

echo "=== Kubelet config file permissions remediation ==="

# Check if the kubelet config file exists
if [ ! -e "$CONFIG_FILE" ]; then
  echo "INFO: $CONFIG_FILE does not exist on this node. Nothing to do."
  exit 0
fi

# Get current permissions (numeric)
CURRENT_MODE="$(stat -c '%a' "$CONFIG_FILE")"

echo "Current permissions on $CONFIG_FILE: $CURRENT_MODE"

# If current mode is already <= 644 (more restrictive), leave it as is
# Otherwise, set to 644.
# To compare numerically, strip leading zeros if present.
CURRENT_MODE_NUM=$((10#$CURRENT_MODE))
DESIRED_MODE_NUM=$((10#$DESIRED_MODE))

if [ "$CURRENT_MODE_NUM" -le "$DESIRED_MODE_NUM" ]; then
  echo "INFO: Permissions $CURRENT_MODE are already 0644 or more restrictive. No change needed."
else
  echo "INFO: Permissions $CURRENT_MODE are too permissive. Setting to $DESIRED_MODE."
  chmod "$DESIRED_MODE" "$CONFIG_FILE"
fi

# Verification (mirrors the audit command)
echo "=== Verification ==="
/bin/sh -c "if test -e $CONFIG_FILE; then stat -c permissions=%a $CONFIG_FILE; fi"

# Final check: ensure the resulting permissions are <= 644
FINAL_MODE="$(stat -c '%a' "$CONFIG_FILE")"
FINAL_MODE_NUM=$((10#$FINAL_MODE))

if [ "$FINAL_MODE_NUM" -le "$DESIRED_MODE_NUM" ]; then
  echo "SUCCESS: $CONFIG_FILE permissions are now $FINAL_MODE (644 or more restrictive)."
  exit 0
else
  echo "ERROR: Failed to set $CONFIG_FILE permissions to 644 or more restrictive. Current: $FINAL_MODE" >&2
  exit 1
fi