Controller Manager Kubeconfig File Permissions Should Be 600 Or More Restrictive

#!/usr/bin/env bash
#
# Fixes CIS Kubernetes 1.1.17:
# Ensures /etc/kubernetes/controller-manager.conf has file mode 600 (or more restrictive).
#
# Run on: every control plane node
# Usage: sudo ./fix-controller-manager-kubeconfig-perms.sh

set -euo pipefail

TARGET_FILE="/etc/kubernetes/controller-manager.conf"
DESIRED_MODE="600"

echo "[INFO] Checking for ${TARGET_FILE}"

if [ ! -e "${TARGET_FILE}" ]; then
  echo "[WARN] ${TARGET_FILE} does not exist on this node. Nothing to do."
else
  # Get current permissions in octal (e.g. 640, 600, 444)
  CURRENT_MODE="$(stat -c '%a' "${TARGET_FILE}")"

  echo "[INFO] Current mode for ${TARGET_FILE}: ${CURRENT_MODE}"

  if [ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]; then
    echo "[INFO] Setting mode ${DESIRED_MODE} on ${TARGET_FILE}"
    chmod "${DESIRED_MODE}" "${TARGET_FILE}"
  else
    echo "[INFO] Mode already ${DESIRED_MODE}; no change needed."
  fi

  # Verification (adapted from the audit command)
  echo "[INFO] Verifying permissions:"
  stat -c 'permissions=%a path=%n' "${TARGET_FILE}"

  FINAL_MODE="$(stat -c '%a' "${TARGET_FILE}")"
  if [ "${FINAL_MODE}" != "${DESIRED_MODE}" ]; then
    echo "[ERROR] Failed to enforce mode ${DESIRED_MODE} on ${TARGET_FILE} (current: ${FINAL_MODE})" >&2
    exit 1
  fi

  echo "[INFO] Verification successful: ${TARGET_FILE} is set to ${DESIRED_MODE}"
fi