Kubelet config.yaml File Permissions Set To 600 Or More Restrictive

#!/usr/bin/env bash
#
# Remediate CIS Kubernetes 4.1.9:
# Ensure /var/lib/kubelet/config.yaml permissions are 600 or more restrictive
# Scope: run on every worker node (can also be run on control plane nodes; it
#        will only act if the file exists).
set -euo pipefail

CONFIG_PATH="/var/lib/kubelet/config.yaml"
DESIRED_MODE="600"

echo "==> CIS 4.1.9: Ensuring ${CONFIG_PATH} permissions are ${DESIRED_MODE} on this node"

if [ ! -e "${CONFIG_PATH}" ]; then
  echo "    File not found: ${CONFIG_PATH} (nothing to do on this node)"
else
  # Get current mode without leading zeros (e.g. 600, 640, 644)
  CURRENT_MODE="$(stat -c '%a' "${CONFIG_PATH}")"

  if [ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]; then
    echo "    Current mode is ${CURRENT_MODE}, setting to ${DESIRED_MODE}"
    chmod "${DESIRED_MODE}" "${CONFIG_PATH}"
  else
    echo "    Mode already ${DESIRED_MODE}, no change needed"
  fi

  # Verification step (from the audit command)
  echo "==> Verifying permissions"
  /bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c permissions=%a /var/lib/kubelet/config.yaml; fi'
fi

echo "==> Completed CIS 4.1.9 remediation on this node"

# From your admin machine, example with SSH (adjust hostnames/IPs and user)
for NODE in worker1 worker2 worker3; do
  echo "=== ${NODE} ==="
  scp /tmp/fix-kubelet-config-perms.sh "${NODE}:/tmp/fix-kubelet-config-perms.sh"
  ssh "${NODE}" "sudo bash /tmp/fix-kubelet-config-perms.sh"
done