Ensure Kubelet Service File Permissions Are Restrictive

#!/usr/bin/env bash
#
# Harden kubelet systemd drop-in permissions (CIS 4.1.1)
# Targets: every worker node
# Idempotent: safe to run multiple times

set -euo pipefail

TARGET_FILE="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
DESIRED_MODE="644"

echo "==> Checking kubelet service drop-in: ${TARGET_FILE}"

if [ ! -e "${TARGET_FILE}" ]; then
  echo "File not found: ${TARGET_FILE}"
  echo "Nothing to change on this node."
  exit 0
fi

current_mode="$(stat -c '%a' "${TARGET_FILE}")"

if [ "${current_mode}" != "${DESIRED_MODE}" ]; then
  echo "Current mode is ${current_mode}, setting to ${DESIRED_MODE}"
  chmod "${DESIRED_MODE}" "${TARGET_FILE}"
else
  echo "Permissions already set to ${DESIRED_MODE}, no change needed."
fi

echo "==> Verifying permissions"
audit_output="$(stat -c permissions=%a "${TARGET_FILE}")"
echo "${audit_output}"

if [ "${audit_output}" != "permissions=${DESIRED_MODE}" ]; then
  echo "ERROR: permission verification failed; expected permissions=${DESIRED_MODE}" >&2
  exit 1
fi

echo "Permissions successfully set to ${DESIRED_MODE} on ${TARGET_FILE}"