Ensure Kube-Proxy Kubeconfig File Permissions Are 644 Or More Restrictive

#!/usr/bin/env bash
# Purpose: Ensure /var/lib/kubelet/kubeconfig permissions are 0644 on all worker nodes
# Usage: Run on any machine with SSH access to every worker node.
#        Provide a file with one worker node (hostname or IP) per line.
#
# Example:
#   ./fix-kubeconfig-perms.sh workers.txt

set -euo pipefail

WORKER_LIST_FILE="${1:-}"

if [[ -z "$WORKER_LIST_FILE" || ! -f "$WORKER_LIST_FILE" ]]; then
  echo "Usage: $0 /path/to/worker-nodes.txt" >&2
  exit 1
fi

# SSH options (tune as needed)
SSH_OPTS="-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5"

fix_node() {
  local node="$1"
  echo "=== [$node] Checking /var/lib/kubelet/kubeconfig ==="

  ssh $SSH_OPTS "$node" 'bash -s' << 'REMOTE_EOF'
set -euo pipefail

FILE="/var/lib/kubelet/kubeconfig"

if [[ ! -e "$FILE" ]]; then
  echo "File not found: $FILE (skipping)"
  exit 0
fi

CURRENT_PERMS="$(stat -c %a "$FILE")"

# Make idempotent: only change if needed
if [[ "$CURRENT_PERMS" != "644" ]]; then
  echo "Current permissions: $CURRENT_PERMS, setting to 644"
  chmod 644 "$FILE"
else
  echo "Permissions already 644 (no change needed)"
fi

# Verification (mirrors audit)
stat -c permissions=%a "$FILE"
REMOTE_EOF
}

while IFS= read -r node; do
  # Skip blank lines and comments
  [[ -z "$node" || "$node" =~ ^# ]] && continue
  fix_node "$node" || echo "!!! Failed on $node" >&2
done < "$WORKER_LIST_FILE"