If Proxy Kubeconfig File Exists Ensure Permissions Are Restrictive

#!/usr/bin/env bash
#
# Harden kube-proxy kubeconfig permissions on every worker node.
# Usage:
#   1) Put all worker node hostnames/IPs into /root/worker-nodes.txt on a machine
#      that has SSH access to them (e.g., bastion/jump host).
#   2) Run this script on that bastion/jump host.
#
# Notes:
# - Idempotent: safe to run multiple times.
# - Only changes permissions if the file exists on the worker node.

set -euo pipefail

WORKER_LIST_FILE="/root/worker-nodes.txt"
REMOTE_FILE="/var/lib/kube-proxy/config.conf"
SSH_OPTS="-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5"

if [[ ! -f "${WORKER_LIST_FILE}" ]]; then
  echo "Worker node list file not found: ${WORKER_LIST_FILE}" >&2
  exit 1
fi

echo "Starting kube-proxy kubeconfig permission hardening..."
echo "Target file on worker nodes: ${REMOTE_FILE}"
echo

while IFS= read -r NODE || [[ -n "$NODE" ]]; do
  # Skip empty or commented lines
  [[ -z "$NODE" || "$NODE" =~ ^# ]] && continue

  echo "=== Node: ${NODE} ==="

  # Check if the file exists
  if ! ssh ${SSH_OPTS} "root@${NODE}" "test -e '${REMOTE_FILE}'"; then
    echo "  File not found: ${REMOTE_FILE} (skipping)"
    echo
    continue
  fi

  # Get current permissions
  CURRENT_PERMS=$(ssh ${SSH_OPTS} "root@${NODE}" "stat -c '%a' '${REMOTE_FILE}'" || echo "unknown")

  if [[ "${CURRENT_PERMS}" != "unknown" ]]; then
    echo "  Current permissions: ${CURRENT_PERMS}"
  else
    echo "  Could not read current permissions; continuing with chmod"
  fi

  # Apply chmod 644 (idempotent)
  ssh ${SSH_OPTS} "root@${NODE}" "chmod 644 '${REMOTE_FILE}'"

  # Verify
  NEW_PERMS=$(ssh ${SSH_OPTS} "root@${NODE}" "stat -c '%a' '${REMOTE_FILE}'")
  echo "  New permissions: ${NEW_PERMS}"

  if [[ "${NEW_PERMS}" -gt 644 ]]; then
    echo "  WARNING: Permissions are more permissive than 644 after change." >&2
    echo "           Investigate manually on ${NODE} for ${REMOTE_FILE}." >&2
  fi

  echo
done < "${WORKER_LIST_FILE}"

echo "Verification summary:"
echo "Re-running audit on each node to confirm permissions are 644 or more restrictive."
echo

while IFS= read -r NODE || [[ -n "$NODE" ]]; do
  [[ -z "$NODE" || "$NODE" =~ ^# ]] && continue

  echo "--- Node: ${NODE} ---"
  ssh ${SSH_OPTS} "root@${NODE}" "/bin/sh -c 'if test -e \"${REMOTE_FILE}\"; then stat -c permissions=%a \"${REMOTE_FILE}\"; else echo \"${REMOTE_FILE} not present\"; fi'"
  echo
done < "${WORKER_LIST_FILE}"

echo "Completed."