Ensure Etcd Pod Specification File Permissions Are Restrictive

#!/usr/bin/env bash
#
# Remediate CIS Kubernetes 1.1.7:
# Ensure /etc/kubernetes/manifests/etcd.yaml permissions are 644 or more restrictive.
#
# Run on: every control plane node
# Usage: sudo /root/fix_etcd_manifest_perms.sh

set -euo pipefail

ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"
TARGET_MODE="644"

echo "==> Checking for ${ETCD_MANIFEST}"
if [ ! -e "${ETCD_MANIFEST}" ]; then
  echo "File ${ETCD_MANIFEST} does not exist on this node; nothing to do."
  exit 0
fi

# Get current mode in numeric form (e.g. 640, 644, 600)
CURRENT_MODE="$(stat -c '%a' "${ETCD_MANIFEST}")"

echo "Current permissions: ${CURRENT_MODE}"
echo "Target permissions : ${TARGET_MODE}"

if [ "${CURRENT_MODE}" != "${TARGET_MODE}" ]; then
  echo "Updating permissions on ${ETCD_MANIFEST} to ${TARGET_MODE}"
  chmod "${TARGET_MODE}" "${ETCD_MANIFEST}"
else
  echo "Permissions already set to ${TARGET_MODE}; no change needed."
fi

# Verification (from the benchmark audit command)
echo "==> Verifying result"
if test -e "${ETCD_MANIFEST}"; then
  /bin/sh -c "find ${ETCD_MANIFEST} -name '*etcd*' | xargs stat -c permissions=%a"
fi

# Final check to ensure compliance (exit non-zero if not compliant)
FINAL_MODE="$(stat -c '%a' "${ETCD_MANIFEST}")"
if [ "${FINAL_MODE}" != "${TARGET_MODE}" ]; then
  echo "ERROR: Expected permissions ${TARGET_MODE}, but found ${FINAL_MODE} after remediation." >&2
  exit 1
fi

echo "Remediation successful: ${ETCD_MANIFEST} permissions are ${FINAL_MODE}."