If Proxy Kubeconfig File Exists Ensure Ownership Is Root

#!/usr/bin/env bash
#
# Remediation for:
# "If Proxy Kubeconfig File Exists Ensure Ownership Is Root" (CIS Kubernetes 4.1.4)
#
# Scope: Run on every worker node.
# Action: If /var/lib/kube-proxy/config.conf exists, set ownership to root:root.
# Safe to re-run: yes (idempotent).

set -euo pipefail

TARGET_FILE="/var/lib/kube-proxy/config.conf"

echo "=== CIS 4.1.4: Ensure kube-proxy kubeconfig ownership is root:root ==="
echo "Node: $(hostname -f || hostname)"

if [ ! -e "$TARGET_FILE" ]; then
  echo "Target file does not exist on this node: $TARGET_FILE"
  echo "Nothing to change."
else
  echo "Found kube-proxy config: $TARGET_FILE"

  current_owner_group=$(stat -c '%U:%G' "$TARGET_FILE")
  echo "Current ownership: $current_owner_group"

  if [ "$current_owner_group" != "root:root" ]; then
    echo "Updating ownership to root:root ..."
    chown root:root "$TARGET_FILE"
  else
    echo "Ownership already set to root:root; no change needed."
  fi

  # Verification (adapted from audit)
  echo "Verifying ownership ..."
  verified_owner_group=$(stat -c '%U:%G' "$TARGET_FILE")
  echo "Verified ownership: $verified_owner_group"

  if [ "$verified_owner_group" != "root:root" ]; then
    echo "ERROR: Failed to set ownership on $TARGET_FILE (expected root:root)" >&2
    exit 1
  fi

  echo "SUCCESS: $TARGET_FILE ownership is correctly set to root:root"
fi