Ensure Kubelet Kubeconfig File Permissions Are 644 Or More Restrictive

#!/usr/bin/env bash
set -euo pipefail

# Automation for: Ensure Kubelet Kubeconfig File Permissions Are 644 Or More Restrictive
# Scope: run on every worker node (or from an admin host using SSH fan-out, see notes below)

KUBELET_KUBECONFIG="/etc/kubernetes/kubelet.conf"
DESIRED_MODE="644"
EXIT_CODE=0

echo "=== [$(hostname)] Checking kubelet kubeconfig permissions ==="

if [ ! -e "$KUBELET_KUBECONFIG" ]; then
  echo "File not found: $KUBELET_KUBECONFIG (nothing to change on this node)"
  exit 0
fi

# Show current state
CURRENT_MODE="$(stat -c '%a' "$KUBELET_KUBECONFIG")"
echo "Current mode on $KUBELET_KUBECONFIG: $CURRENT_MODE"

# Apply fix only if needed
if [ "$CURRENT_MODE" != "$DESIRED_MODE" ]; then
  echo "Setting permissions to $DESIRED_MODE on $KUBELET_KUBECONFIG"
  chmod "$DESIRED_MODE" "$KUBELET_KUBECONFIG"
else
  echo "Permissions already at $DESIRED_MODE; no change needed"
fi

# Verification (same logic as the audit command)
echo "Verifying permissions..."
VERIFY_OUTPUT="$(/bin/sh -c "if test -e $KUBELET_KUBECONFIG; then stat -c permissions=%a $KUBELET_KUBECONFIG; fi")"
echo "$VERIFY_OUTPUT"

if ! echo "$VERIFY_OUTPUT" | grep -q "permissions=$DESIRED_MODE"; then
  echo "ERROR: Expected permissions=$DESIRED_MODE but got: $VERIFY_OUTPUT" >&2
  EXIT_CODE=1
else
  echo "Success: kubelet kubeconfig file permissions are set to $DESIRED_MODE"
fi

exit "$EXIT_CODE"