Kubelet Service File Ownership Set To root:root

#!/usr/bin/env bash
#
# Fix CISKubernetes 4.1.2:
# Ensure kubelet service file ownership is set to root:root
#
# Usage:
#   1) Copy this script to every worker node (or run via SSH/Ansible).
#   2) Run as root:  sudo bash ./fix-kubelet-service-ownership.sh

set -euo pipefail

KUBELET_UNIT_OVERRIDE="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"

echo "[INFO] Checking kubelet service file on this node: ${KUBELET_UNIT_OVERRIDE}"

if [ ! -e "${KUBELET_UNIT_OVERRIDE}" ]; then
  echo "[WARN] File not found: ${KUBELET_UNIT_OVERRIDE}"
  echo "[WARN] Nothing to change on this node."
  exit 0
fi

# Current ownership
current_owner_group="$(stat -c '%U:%G' "${KUBELET_UNIT_OVERRIDE}")" || {
  echo "[ERROR] Failed to stat ${KUBELET_UNIT_OVERRIDE}"
  exit 1
}

echo "[INFO] Current ownership: ${current_owner_group}"

# Only change if needed (idempotent)
if [ "${current_owner_group}" != "root:root" ]; then
  echo "[INFO] Updating ownership to root:root"
  chown root:root "${KUBELET_UNIT_OVERRIDE}"
else
  echo "[INFO] Ownership already root:root; no change needed."
fi

# Verification (as per audit command)
echo "[INFO] Verifying ownership after change:"
audit_result="$(
  /bin/sh -c "if test -e ${KUBELET_UNIT_OVERRIDE}; then stat -c %U:%G ${KUBELET_UNIT_OVERRIDE}; else echo 'File not found'; fi"
)"

echo "[INFO] Audit output: ${audit_result}"

if [ "${audit_result}" != "root:root" ]; then
  echo "[ERROR] Verification failed: expected root:root, got ${audit_result}"
  exit 1
fi

echo "[INFO] Verification successful: kubelet service file is owned by root:root"
exit 0