Ensure Controller Manager Configuration File Permissions Are Restrictive

#!/usr/bin/env bash
#
# Fix CISKubernetes 1.1.17:
# Ensure /etc/kubernetes/controller-manager.conf permissions are 644 or more restrictive
#
# Usage:
#   Run on every control plane node as root (or with sudo):
#     sudo bash ./fix-controller-manager-conf-perms.sh
#
# Idempotent: safe to re-run.

set -euo pipefail

CONFIG_PATH="/etc/kubernetes/controller-manager.conf"
REQUIRED_MODE="644"

echo "=== Checking for ${CONFIG_PATH} ==="
if [ ! -e "${CONFIG_PATH}" ]; then
  echo "File not found: ${CONFIG_PATH}"
  echo "Nothing to do on this node."
  exit 0
fi

# Get current permissions in numeric form (e.g. 640, 644)
CURRENT_MODE="$(stat -c '%a' "${CONFIG_PATH}")"
echo "Current permissions: ${CURRENT_MODE}"

if [ "${CURRENT_MODE}" = "${REQUIRED_MODE}" ]; then
  echo "Permissions already set to ${REQUIRED_MODE}. No change needed."
else
  echo "Setting permissions on ${CONFIG_PATH} to ${REQUIRED_MODE}"
  chmod "${REQUIRED_MODE}" "${CONFIG_PATH}"
fi

echo "=== Verifying permissions ==="
/bin/sh -c "stat -c permissions=%a ${CONFIG_PATH}"

FINAL_MODE="$(stat -c '%a' "${CONFIG_PATH}")"
if [ "${FINAL_MODE}" != "${REQUIRED_MODE}" ]; then
  echo "ERROR: Expected permissions ${REQUIRED_MODE}, but found ${FINAL_MODE} after chmod." >&2
  exit 1
fi

echo "Permissions successfully set to ${REQUIRED_MODE} on ${CONFIG_PATH}."