Kubelet config.yaml File Ownership Set To root:root

#!/usr/bin/env bash
#
# Remediate CIS Kubernetes 4.1.10:
# Ensure /var/lib/kubelet/config.yaml (if present) is owned by root:root
#
# Run this script on every worker node with root privileges.
# It is safe to re-run.

set -euo pipefail

CONFIG_PATH="/var/lib/kubelet/config.yaml"

echo "=== CIS 4.1.10 remediation: kubelet config.yaml ownership ==="

if [ ! -e "$CONFIG_PATH" ]; then
  echo "INFO: $CONFIG_PATH does not exist on this node. Nothing to do."
  exit 0
fi

current_owner="$(stat -c '%U:%G' "$CONFIG_PATH")"
echo "Current ownership of $CONFIG_PATH: $current_owner"

if [ "$current_owner" != "root:root" ]; then
  echo "Changing ownership of $CONFIG_PATH to root:root ..."
  chown root:root "$CONFIG_PATH"
else
  echo "Ownership already set to root:root, no change needed."
fi

# Verification (from benchmark audit command)
echo "Verifying ownership..."
verified_owner="$(stat -c '%U:%G' "$CONFIG_PATH")"
echo "Verified ownership of $CONFIG_PATH: $verified_owner"

if [ "$verified_owner" != "root:root" ]; then
  echo "ERROR: Failed to set ownership of $CONFIG_PATH to root:root" >&2
  exit 1
fi

echo "SUCCESS: $CONFIG_PATH ownership is correctly set to root:root."