Ensure Container Network Interface File Ownership Is Root

#!/usr/bin/env bash
#
# Fix ownership of Container Network Interface files to root:root
# Scope: run on every control plane node
# Safe to re-run; only changes non-root-owned files.
set -euo pipefail

echo "=== Detecting CNI configuration directory from kubelet arguments (if present) ==="
CNI_CONF_DIRS=()

# Try to detect --cni-conf-dir from running kubelet
if pgrep -x kubelet >/dev/null 2>&1; then
  DETECTED_DIRS=$(ps -ef | grep kubelet | grep -- --cni-conf-dir \
    | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' || true)
  if [ -n "${DETECTED_DIRS}" ]; then
    while IFS= read -r d; do
      [ -n "$d" ] && CNI_CONF_DIRS+=("$d")
    done <<< "${DETECTED_DIRS}"
  fi
fi

# Always include /var/lib/cni/networks as per finding
CNI_DATA_DIR="/var/lib/cni/networks"
if [ -d "${CNI_DATA_DIR}" ]; then
  CNI_CONF_DIRS+=("${CNI_DATA_DIR}")
fi

# De-duplicate directories
if [ "${#CNI_CONF_DIRS[@]}" -eq 0 ]; then
  echo "No CNI directories detected and /var/lib/cni/networks not found; nothing to do."
  exit 0
fi
readarray -t CNI_CONF_DIRS < <(printf '%s\n' "${CNI_CONF_DIRS[@]}" | awk '!x[$0]++')

echo "CNI directories to process:"
printf '  %s\n' "${CNI_CONF_DIRS[@]}"

echo "=== Ensuring ownership root:root for CNI files ==="
for dir in "${CNI_CONF_DIRS[@]}"; do
  if [ ! -d "$dir" ]; then
    echo "Skipping non-existent directory: $dir"
    continue
  fi
  echo "Processing directory: $dir"

  # Find files not owned by root:root and fix them
  # -print0 handles spaces/newlines in filenames safely
  find "$dir" -type f ! -user root -o -type f ! -group root -print0 2>/dev/null \
    | while IFS= read -r -d '' file; do
        echo "  Fixing ownership: $file"
        chown root:root "$file"
      done
done

echo "=== Verification ==="

# Verification 1: using kubelet --cni-conf-dir (if any)
if pgrep -x kubelet >/dev/null 2>&1; then
  CONF_DIR_FROM_KUBELET=$(ps -ef | grep kubelet | grep -- --cni-conf-dir \
    | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' || true)
  if [ -n "${CONF_DIR_FROM_KUBELET}" ]; then
    echo "--- Ownership under kubelet --cni-conf-dir ---"
    echo "${CONF_DIR_FROM_KUBELET}" \
      | xargs -I{} find {} -mindepth 1 2>/dev/null \
      | xargs --no-run-if-empty stat -c '%n %U:%G'
  else
    echo "No --cni-conf-dir flag detected in kubelet process for verification."
  fi
else
  echo "kubelet process not found; skipping kubelet-based verification."
fi

# Verification 2: /var/lib/cni/networks
if [ -d "${CNI_DATA_DIR}" ]; then
  echo "--- Ownership under ${CNI_DATA_DIR} ---"
  find "${CNI_DATA_DIR}" -type f 2>/dev/null \
    | xargs --no-run-if-empty stat -c '%n %U:%G'
else
  echo "${CNI_DATA_DIR} not present; skipping data-dir verification."
fi

echo "=== Completed. Confirm all entries above show root:root ==="