Ensure Kubelet Configuration File Permissions Are Set To 644

#!/usr/bin/env bash
#
# Fix CIS GKE 3.1.3: Ensure Kubelet Configuration File Permissions Are Set To 644
# Target: every worker node
#
# Usage:
#   1) Create a file "workers.txt" with one worker node (hostname or IP) per line.
#   2) Ensure SSH key-based auth and sudo privileges are configured for the remote user.
#   3) Run: ./fix-kubelet-perms.sh workers.txt
#
# This script is idempotent and safe to re-run.

set -euo pipefail

if [[ $# -ne 1 ]]; then
  echo "Usage: $0 <workers_list_file>" >&2
  exit 1
fi

WORKERS_FILE="$1"

if [[ ! -f "$WORKERS_FILE" ]]; then
  echo "Workers list file not found: $WORKERS_FILE" >&2
  exit 1
fi

REMOTE_USER="${REMOTE_USER:-ubuntu}"   # set REMOTE_USER env if different
KUBELET_CONFIG_PATH="/home/kubernetes/kubelet-config.yaml"

while IFS= read -r NODE || [[ -n "$NODE" ]]; do
  # Skip empty lines and comments
  [[ -z "$NODE" || "$NODE" =~ ^# ]] && continue

  echo "==== Processing worker node: $NODE ===="

  ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "${REMOTE_USER}@${NODE}" bash -s <<EOF
set -euo pipefail

CONFIG_PATH="$KUBELET_CONFIG_PATH"

if [[ ! -e "\$CONFIG_PATH" ]]; then
  echo "[$NODE] kubelet config file not found at \$CONFIG_PATH - skipping"
  exit 0
fi

CURRENT_PERMS=\$(stat -c "%a" "\$CONFIG_PATH")
echo "[$NODE] Current permissions: \$CURRENT_PERMS"

# Apply remediation only if needed
if [[ "\$CURRENT_PERMS" != "644" ]]; then
  echo "[$NODE] Updating permissions to 644"
  sudo chmod 644 "\$CONFIG_PATH"
else
  echo "[$NODE] Permissions already 644 - no change needed"
fi

# Verification (adapted from audit command)
VERIFY_PERMS=\$(stat -c "permissions=%a" "\$CONFIG_PATH")
echo "[$NODE] Verification: \$VERIFY_PERMS"

if [[ "\$VERIFY_PERMS" != "permissions=644" ]]; then
  echo "[$NODE] ERROR: verification failed, expected permissions=644 but got \$VERIFY_PERMS" >&2
  exit 1
fi

echo "[$NODE] Success: kubelet config permissions correctly set to 644"
EOF

  echo
done < "$WORKERS_FILE"

echo "All listed worker nodes processed."