Controller Manager Kubeconfig File Ownership Should Be root:root

#!/usr/bin/env bash
#
# Fix ownership of /etc/kubernetes/controller-manager.conf to root:root
# Scope: run on every control plane node
# Idempotent and safe to re-run

set -euo pipefail

TARGET_FILE="/etc/kubernetes/controller-manager.conf"
REQUIRED_OWNER="root"
REQUIRED_GROUP="root"

echo "=== Controller Manager kubeconfig ownership remediation ==="

if [[ ! -e "$TARGET_FILE" ]]; then
  echo "File not found: $TARGET_FILE"
  echo "Nothing to change on this node."
  exit 0
fi

# Get current ownership
CURRENT_OWNER="$(stat -c %U "$TARGET_FILE")"
CURRENT_GROUP="$(stat -c %G "$TARGET_FILE")"

echo "Current ownership of $TARGET_FILE: ${CURRENT_OWNER}:${CURRENT_GROUP}"

# Apply fix only if needed
if [[ "$CURRENT_OWNER" != "$REQUIRED_OWNER" || "$CURRENT_GROUP" != "$REQUIRED_GROUP" ]]; then
  echo "Updating ownership to ${REQUIRED_OWNER}:${REQUIRED_GROUP} ..."
  chown "${REQUIRED_OWNER}:${REQUIRED_GROUP}" "$TARGET_FILE"
else
  echo "Ownership already set to ${REQUIRED_OWNER}:${REQUIRED_GROUP}; no change needed."
fi

# Verification (adapted from audit command)
echo "Verifying ownership..."
RESULT="$(stat -c %U:%G "$TARGET_FILE")"
echo "stat -c %U:%G $TARGET_FILE => $RESULT"

if [[ "$RESULT" != "${REQUIRED_OWNER}:${REQUIRED_GROUP}" ]]; then
  echo "ERROR: Failed to set ownership to ${REQUIRED_OWNER}:${REQUIRED_GROUP} on $TARGET_FILE" >&2
  exit 1
fi

echo "Success: $TARGET_FILE ownership is correctly set to ${REQUIRED_OWNER}:${REQUIRED_GROUP}."

chmod 700 /usr/local/sbin/fix-controller-manager-kubeconfig-ownership-ownership.sh

/usr/local/sbin/fix-controller-manager-kubeconfig-ownership-ownership.sh