Ensure Kubelet Config File Ownership Is Root

#!/usr/bin/env bash
#
# Remediate CIS Kubernetes 4.1.10:
# Ensure kubelet config file /var/lib/kubelet/config.yaml is owned by root:root
#
# Run on: every worker node (and any control-plane node that also runs kubelet)
# Usage: sudo ./fix-kubelet-config-ownership.sh

set -euo pipefail

CONFIG_FILE="/var/lib/kubelet/config.yaml"

echo "[-] Checking for kubelet config file at ${CONFIG_FILE}"

if [ ! -e "${CONFIG_FILE}" ]; then
  echo "[*] File ${CONFIG_FILE} does not exist on this node. Nothing to do."
  exit 0
fi

# Get current ownership
CURRENT_OWNER_GROUP="$(stat -c '%U:%G' "${CONFIG_FILE}")"

echo "[-] Current ownership of ${CONFIG_FILE}: ${CURRENT_OWNER_GROUP}"

# If already root:root, nothing to change
if [ "${CURRENT_OWNER_GROUP}" = "root:root" ]; then
  echo "[*] Ownership already set to root:root. No changes made."
else
  echo "[-] Setting ownership of ${CONFIG_FILE} to root:root"
  chown root:root "${CONFIG_FILE}"
fi

# Verification (adapted from audit command)
echo "[-] Verifying ownership after remediation"
FINAL_OWNER_GROUP="$(stat -c '%U:%G' "${CONFIG_FILE}")"
echo "[*] Final ownership of ${CONFIG_FILE}: ${FINAL_OWNER_GROUP}"

if [ "${FINAL_OWNER_GROUP}" != "root:root" ]; then
  echo "[!] ERROR: Failed to set ownership of ${CONFIG_FILE} to root:root" >&2
  exit 1
fi

echo "[+] Remediation successful: ${CONFIG_FILE} is owned by root:root"