Ensure Kube-Proxy Kubeconfig File Ownership Is Set To root:root

#!/usr/bin/env bash
#
# Fix CIS GKE 3.1.2: Ensure kubelet kubeconfig file ownership is set to root:root
# Scope: run on every worker node (as root). Safe to re-run.

set -euo pipefail

KUBECONFIG_PATH="/var/lib/kubelet/kubeconfig"
DESIRED_OWNER="root"
DESIRED_GROUP="root"

echo "=== CIS GKE 3.1.2: kubelet kubeconfig ownership ==="

if [ ! -e "$KUBECONFIG_PATH" ]; then
  echo "INFO: $KUBECONFIG_PATH does not exist on this node; nothing to do."
  exit 0
fi

current_owner="$(stat -c '%U' "$KUBECONFIG_PATH")"
current_group="$(stat -c '%G' "$KUBECONFIG_PATH")"

if [ "$current_owner" = "$DESIRED_OWNER" ] && [ "$current_group" = "$DESIRED_GROUP" ]; then
  echo "OK: $KUBECONFIG_PATH already owned by ${DESIRED_OWNER}:${DESIRED_GROUP}."
else
  echo "FIX: Setting ownership of $KUBECONFIG_PATH to ${DESIRED_OWNER}:${DESIRED_GROUP}..."
  chown "${DESIRED_OWNER}:${DESIRED_GROUP}" "$KUBECONFIG_PATH"
fi

echo "=== Verifying ownership ==="
/bin/sh -c "if test -e $KUBECONFIG_PATH; then stat -c %U:%G $KUBECONFIG_PATH; fi"

final_owner_group="$(stat -c '%U:%G' "$KUBECONFIG_PATH")"
if [ "$final_owner_group" != "${DESIRED_OWNER}:${DESIRED_GROUP}" ]; then
  echo "ERROR: Ownership verification failed; expected ${DESIRED_OWNER}:${DESIRED_GROUP}, got $final_owner_group" >&2
  exit 1
fi

echo "SUCCESS: $KUBECONFIG_PATH ownership is ${DESIRED_OWNER}:${DESIRED_GROUP}."