Ensure API Server Pod Specification File Ownership Is Root

#!/usr/bin/env bash
# Automation to enforce root:root ownership on kube-apiserver pod spec
# Scope: run on every control plane node

set -euo pipefail

APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"

echo "=== [1/3] Checking for kube-apiserver manifest at ${APISERVER_MANIFEST}"

if [ ! -e "${APISERVER_MANIFEST}" ]; then
  echo "Manifest not found at ${APISERVER_MANIFEST}. Nothing to change on this node."
  exit 0
fi

echo "=== [2/3] Setting file owner and group to root:root (idempotent)"

# Idempotent: chown only if needed
current_owner_group="$(stat -c '%U:%G' "${APISERVER_MANIFEST}")"
if [ "${current_owner_group}" != "root:root" ]; then
  chown root:root "${APISERVER_MANIFEST}"
  echo "Updated ownership from ${current_owner_group} to root:root"
else
  echo "Ownership already root:root, no change needed"
fi

echo "=== [3/3] Verifying ownership (CIS 1.1.2 check)"

audit_output="$(stat -c %U:%G "${APISERVER_MANIFEST}")"
echo "Current ownership: ${audit_output}"

if [ "${audit_output}" != "root:root" ]; then
  echo "FAIL: Ownership is not root:root after remediation" >&2
  exit 1
fi

echo "PASS: kube-apiserver manifest ownership is correctly set to root:root"