Etcd Pod Specification File Permissions Should Be 600 Or More Restrictive

#!/usr/bin/env bash
#
# Remediate CIS Kubernetes 1.1.7:
# Ensure that the etcd pod specification file permissions are set to 600 or more restrictive.
#
# Run on: every control plane node (with root or sudo access).
# Safe to re-run (idempotent).

set -euo pipefail

ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"
DESIRED_MODE="600"

echo "=== CIS 1.1.7: Fix etcd manifest permissions on this control plane node ==="

if [[ ! -e "$ETCD_MANIFEST" ]]; then
  echo "Etcd manifest not found at $ETCD_MANIFEST – nothing to do on this node."
  exit 0
fi

# Show current permissions
CURRENT_MODE="$(stat -c '%a' "$ETCD_MANIFEST" || echo 'unknown')"
echo "Current permissions on $ETCD_MANIFEST: $CURRENT_MODE"

# Apply fix (idempotent: chmod 600 is safe repeatedly)
echo "Setting permissions on $ETCD_MANIFEST to $DESIRED_MODE ..."
chmod "$DESIRED_MODE" "$ETCD_MANIFEST"

# Verification using the benchmark's audit logic
echo "Verifying permissions using audit-style command..."
VERIFY_OUTPUT="$(/bin/sh -c "if test -e $ETCD_MANIFEST; then find $ETCD_MANIFEST -name '*etcd*' | xargs stat -c permissions=%a; fi")"

echo "Audit output:"
echo "$VERIFY_OUTPUT"

# Parse verification result: expect permissions=600
if echo "$VERIFY_OUTPUT" | grep -q "permissions=${DESIRED_MODE}\b"; then
  echo "SUCCESS: $ETCD_MANIFEST permissions are set to $DESIRED_MODE as required."
  exit 0
else
  echo "ERROR: $ETCD_MANIFEST permissions are not correctly set. Please investigate manually."
  exit 1
fi