API Server Pod Specification File Ownership Should Be root:root

#!/usr/bin/env bash
#
# Fix ownership of kube-apiserver manifest to root:root on all control plane nodes.
# Usage:
#   1) Copy this script to each control plane node and run with sudo:
#        sudo bash fix-kube-apiserver-ownership.sh
#   2) Or run remotely via SSH from an admin host.

set -euo pipefail

MANIFEST_PATH="/etc/kubernetes/manifests/kube-apiserver.yaml"

echo "=== [$(hostname)] Ensuring ownership of ${MANIFEST_PATH} is root:root ==="

# Ensure script is run as root
if [[ "$(id -u)" -ne 0 ]]; then
  echo "ERROR: This script must be run as root (use sudo)." >&2
  exit 1
fi

# Check if file exists
if [[ ! -e "${MANIFEST_PATH}" ]]; then
  echo "NOTICE: ${MANIFEST_PATH} does not exist on this node. Nothing to do."
  exit 0
fi

# Show current ownership
current_owner_group="$(stat -c '%U:%G' "${MANIFEST_PATH}")"
echo "Current ownership: ${current_owner_group}"

# Apply fix only if needed (idempotent)
if [[ "${current_owner_group}" != "root:root" ]]; then
  echo "Changing ownership to root:root..."
  chown root:root "${MANIFEST_PATH}"
else
  echo "Ownership already set to root:root. No change needed."
fi

# Verification
echo "Verifying ownership..."
verified_owner_group="$(stat -c '%U:%G' "${MANIFEST_PATH}")"
echo "Verified ownership: ${verified_owner_group}"

if [[ "${verified_owner_group}" != "root:root" ]]; then
  echo "ERROR: Failed to set ownership to root:root on ${MANIFEST_PATH}" >&2
  exit 2
fi

echo "SUCCESS: ${MANIFEST_PATH} is owned by root:root on node $(hostname)."