Ensure Proxy Kubeconfig File Permissions Are Restrictive

#!/usr/bin/env bash
#
# Hardens kube-proxy kubeconfig permissions on every worker node over SSH.
# Usage:
#   1) Create a file with one worker node hostname/IP per line, e.g. workers.txt
#   2) Run: ./fix-kube-proxy-kubeconfig-perms.sh workers.txt
#
# Requirements:
#   - Passwordless SSH or SSH agent configured for the target nodes.
#   - User must have sudo privileges on the worker nodes.

set -euo pipefail

if [ "${1-}" = "" ]; then
  echo "Usage: $0 <workers_node_list_file>"
  exit 1
fi

NODES_FILE="$1"

if [ ! -f "$NODES_FILE" ]; then
  echo "Node list file not found: $NODES_FILE"
  exit 1
fi

KUBECONFIG_PATH="/var/lib/kube-proxy/config.conf"
DESIRED_MODE="644"

harden_node() {
  local node="$1"
  echo "==> Processing worker node: $node"

  ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "$node" bash -s -- "$KUBECONFIG_PATH" "$DESIRED_MODE" << 'EOSSH'
set -euo pipefail

KUBECONFIG_PATH="$1"
DESIRED_MODE="$2"

if [ ! -e "$KUBECONFIG_PATH" ]; then
  echo "    [INFO] kube-proxy kubeconfig not found at $KUBECONFIG_PATH, skipping."
  exit 0
fi

current_mode="$(stat -c '%a' "$KUBECONFIG_PATH")" || {
  echo "    [ERROR] Failed to read permissions for $KUBECONFIG_PATH"
  exit 1
}

if [ "$current_mode" != "$DESIRED_MODE" ]; then
  echo "    [INFO] Current mode: $current_mode, setting to $DESIRED_MODE"
  sudo chmod "$DESIRED_MODE" "$KUBECONFIG_PATH"
else
  echo "    [OK] Permissions already $DESIRED_MODE; no change needed."
fi

# Verification (adapted from the audit)
verify_mode="$(stat -c 'permissions=%a' "$KUBECONFIG_PATH")"
echo "    [VERIFY] $KUBECONFIG_PATH -> $verify_mode"

if [ "$verify_mode" != "permissions=$DESIRED_MODE" ]; then
  echo "    [FAIL] Permissions not set correctly on $KUBECONFIG_PATH"
  exit 1
fi

echo "    [SUCCESS] kube-proxy kubeconfig permissions are correctly set."
EOSSH

  echo
}

while IFS= read -r node; do
  # Skip empty lines and comments
  if [ -z "$node" ] || [[ "$node" =~ ^# ]]; then
    continue
  fi
  harden_node "$node"
done < "$NODES_FILE"

echo "All done."