Ensure API Server Pod Specification Permissions Are Restrictive

#!/usr/bin/env bash
# Fix CISKubernetes 1.1.1:
# Ensure /etc/kubernetes/manifests/kube-apiserver.yaml has permissions 644 or more restrictive.
# Run on every control plane node.

set -euo pipefail

APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
TARGET_MODE="644"

echo "=== CISKubernetes 1.1.1: Fix API server pod spec permissions ==="

if [ ! -e "$APISERVER_MANIFEST" ]; then
  echo "INFO: $APISERVER_MANIFEST does not exist on this node. Nothing to do."
  exit 0
fi

current_mode="$(stat -c '%a' "$APISERVER_MANIFEST")"
echo "Current permissions: $current_mode"

# Normalize permission to be no more permissive than 644.
# If already 644 or more restrictive (e.g. 640, 600), leave as-is.
if [ "$current_mode" -gt "$TARGET_MODE" ]; then
  echo "Updating permissions to $TARGET_MODE on $APISERVER_MANIFEST"
  chmod "$TARGET_MODE" "$APISERVER_MANIFEST"
else
  echo "Permissions are already $current_mode (644 or more restrictive). No change needed."
fi

# Verification
echo "Verifying permissions..."
verified_mode="$(stat -c '%a' "$APISERVER_MANIFEST")"
echo "Verified permissions: $verified_mode"

if [ "$verified_mode" -le "$TARGET_MODE" ]; then
  echo "SUCCESS: $APISERVER_MANIFEST permissions are $verified_mode (644 or more restrictive)."
  exit 0
else
  echo "ERROR: $APISERVER_MANIFEST permissions are $verified_mode (not 644 or more restrictive)." >&2
  exit 1
fi