Ensure Kubelet Configuration File Permissions Restrictive

#!/usr/bin/env bash
#
# Remediation: Ensure kubelet configuration file permissions are 644 or more restrictive
# Scope: Run on every worker node
# Idempotent: Yes, safe to re-run

set -euo pipefail

KUBELET_CONF="/etc/kubernetes/kubelet-config.yaml"

echo "=== CIS GKE 3.1.3: Ensure Kubelet Configuration File Permissions Restrictive ==="

# 1. Check if the kubelet configuration file exists
if [ ! -e "$KUBELET_CONF" ]; then
  echo "File not found: $KUBELET_CONF"
  echo "Nothing to change on this node."
  exit 0
fi

# 2. Show current permissions
CURRENT_PERMS="$(stat -c '%a' "$KUBELET_CONF")"
echo "Current permissions on $KUBELET_CONF: $CURRENT_PERMS"

# 3. Apply restrictive permissions (644) if needed
if [ "$CURRENT_PERMS" != "644" ]; then
  echo "Setting permissions on $KUBELET_CONF to 644..."
  chmod 644 "$KUBELET_CONF"
else
  echo "Permissions already set to 644. No change needed."
fi

# 4. Verification (same logic as audit command)
echo "Verifying resulting permissions..."
FINAL_PERMS="$(stat -c 'permissions=%a' "$KUBELET_CONF")"
echo "$FINAL_PERMS"

if [ "$FINAL_PERMS" != "permissions=644" ]; then
  echo "ERROR: Expected permissions=644 but found $FINAL_PERMS"
  exit 1
fi

echo "Success: $KUBELET_CONF permissions are correctly set to 644."

bash /usr/local/sbin/fix-cis-gke-3.1.3.sh