Kubelet Service File Permissions Set To 600 Or More Restrictive

#!/usr/bin/env bash
#
# Harden kubelet service file permissions on all worker nodes.
# Usage:
#   1) Put worker node hostnames/IPs into workers.txt (one per line)
#   2) Ensure SSH access and sudo rights to each node
#   3) Run: ./fix-kubelet-perms.sh

set -euo pipefail

WORKERS_FILE="workers.txt"
REMOTE_FILE="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
DESIRED_MODE="600"

if [[ ! -f "$WORKERS_FILE" ]]; then
  echo "workers.txt not found in current directory. Create it with one worker node per line."
  exit 1
fi

echo "Starting kubelet service file permission hardening on worker nodes..."
echo

while IFS= read -r NODE; do
  [[ -z "$NODE" ]] && continue

  echo "=== Node: $NODE ==="

  # Check if file exists on node
  if ! ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "$NODE" "test -e '$REMOTE_FILE'"; then
    echo "  [WARN] $REMOTE_FILE does not exist on this node. Skipping."
    echo
    continue
  fi

  # Get current permissions
  CURRENT_MODE=$(ssh -o BatchMode=yes "$NODE" "stat -c '%a' '$REMOTE_FILE'")
  echo "  Current mode: $CURRENT_MODE"

  # Apply fix only if needed
  if [[ "$CURRENT_MODE" -gt "$DESIRED_MODE" ]]; then
    echo "  Updating permissions to $DESIRED_MODE ..."
    ssh -o BatchMode=yes "$NODE" "sudo chmod $DESIRED_MODE '$REMOTE_FILE'"
  else
    echo "  Permissions already $DESIRED_MODE or more restrictive. No change needed."
  fi

  # Verification (adapted from audit command)
  VERIFY_OUTPUT=$(ssh -o BatchMode=yes "$NODE" "/bin/sh -c 'if test -e $REMOTE_FILE; then stat -c permissions=%a $REMOTE_FILE; fi'")
  echo "  Verification: $VERIFY_OUTPUT"

  # Check for success
  if [[ "$VERIFY_OUTPUT" != "permissions=$DESIRED_MODE" && "$VERIFY_OUTPUT" != permissions=40* && "$VERIFY_OUTPUT" != permissions=50* ]]; then
    # Only treat as strict failure if not exactly 600 or more restrictive (400/440/etc.)
    PERM_VALUE="${VERIFY_OUTPUT#permissions=}"
    if [[ "$PERM_VALUE" -gt "$DESIRED_MODE" ]]; then
      echo "  [ERROR] Permissions still too permissive on $NODE: $VERIFY_OUTPUT"
      exit 1
    fi
  fi

  echo
done < "$WORKERS_FILE"

echo "Completed. Review output above for any warnings or errors."