Controller Manager Should Set Root CA File

#!/usr/bin/env bash
#
# Remediation: Ensure /etc/kubernetes/controller-manager.conf ownership is root:root
# Scope: Run on every control plane node
# Safe to re-run; no service restarts required.

set -euo pipefail

CONFIG_PATH="/etc/kubernetes/controller-manager.conf"

echo "=== [INFO] Starting remediation for controller-manager.conf ownership ==="

if [ ! -e "$CONFIG_PATH" ]; then
  echo "=== [WARN] $CONFIG_PATH does not exist on this node; nothing to do. ==="
  exit 0
fi

current_owner_group="$(stat -c '%U:%G' "$CONFIG_PATH")"

if [ "$current_owner_group" = "root:root" ]; then
  echo "=== [OK] Ownership already correct: $CONFIG_PATH is root:root ==="
else
  echo "=== [INFO] Current ownership is $current_owner_group, changing to root:root ==="
  chown root:root "$CONFIG_PATH"
fi

echo "=== [INFO] Verifying remediation ==="
/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c %U:%G /etc/kubernetes/controller-manager.conf; fi'

verified_owner_group="$(stat -c '%U:%G' "$CONFIG_PATH")"
if [ "$verified_owner_group" != "root:root" ]; then
  echo "=== [ERROR] Verification failed: expected root:root, got $verified_owner_group ==="
  exit 1
fi

echo "=== [SUCCESS] $CONFIG_PATH ownership is correctly set to root:root ==="