Ensure Admin Configuration File Ownership Is Root

#!/usr/bin/env bash
#
# Fix ownership of /etc/kubernetes/admin.conf to root:root
# Scope: run on every control plane node
# Safe to re-run (idempotent)

set -euo pipefail

ADMIN_CONF="/etc/kubernetes/admin.conf"

echo "=== [CIS 1.1.14] Ensure admin.conf ownership is root:root ==="

if [ ! -e "$ADMIN_CONF" ]; then
  echo "File not found: $ADMIN_CONF"
  echo "Nothing to do on this node."
  exit 0
fi

# Show current ownership
current_owner="$(stat -c '%U:%G' "$ADMIN_CONF")"
echo "Current ownership: $current_owner"

# Apply fix if needed
if [ "$current_owner" != "root:root" ]; then
  echo "Setting ownership to root:root on $ADMIN_CONF"
  chown root:root "$ADMIN_CONF"
else
  echo "Ownership already correct; no change needed."
fi

# Verification (same as audit command)
echo "Verifying ownership..."
verify_owner="$(stat -c '%U:%G' "$ADMIN_CONF")"
echo "Verified ownership: $verify_owner"

if [ "$verify_owner" != "root:root" ]; then
  echo "ERROR: Ownership is still not root:root. Manual investigation required." >&2
  exit 1
fi

echo "=== Compliance OK on this node ==="