Default Administrative Credential File Ownership Should Be root:root

for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
  if test -e "$adminconf"; then
    stat -c "ownership=%U:%G %n" "$adminconf"
  fi
done

if test -e /etc/kubernetes/admin.conf; then
  chown root:root /etc/kubernetes/admin.conf
fi

if test -e /etc/kubernetes/super-admin.conf; then
  chown root:root /etc/kubernetes/super-admin.conf
fi

for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
  if test -e "$adminconf"; then
    stat -c "ownership=%U:%G %n" "$adminconf"
  fi
done

#!/usr/bin/env bash
#
# Remediate CIS Kubernetes 1.1.14:
# Ensure /etc/kubernetes/admin.conf and /etc/kubernetes/super-admin.conf
# are owned by root:root on every control plane node.
#
# Run this script as root on each control plane node.
set -euo pipefail

FILES=(
  "/etc/kubernetes/admin.conf"
  "/etc/kubernetes/super-admin.conf"
)

changed=0

echo "==> Ensuring ownership is root:root for default administrative kubeconfig files"

for f in "${FILES[@]}"; do
  if [ -e "$f" ]; then
    # Get current ownership in user:group form
    current_owner="$(stat -c '%U:%G' "$f")"
    if [ "$current_owner" != "root:root" ]; then
      echo " - Fixing ownership on $f (was $current_owner, setting to root:root)"
      chown root:root "$f"
      changed=1
    else
      echo " - Ownership already correct on $f (root:root)"
    fi
  else
    echo " - File not present, skipping: $f"
  fi
done

if [ "$changed" -eq 0 ]; then
  echo "==> No changes were necessary."
else
  echo "==> Ownership updated where required."
fi

echo
echo "==> Verifying ownership:"
for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do
  if test -e "$adminconf"; then
    stat -c "ownership=%U:%G %n" "$adminconf"
  fi
done