Ensure Kubernetes PKI Certificate File Permissions Are Restrictive

#!/usr/bin/env bash
#
# Harden Kubernetes PKI certificate file permissions on control plane nodes.
# Target: every control plane node
# Requirement: all /etc/kubernetes/pki/*.crt must be 644 or more restrictive.
#
# Usage:
#   1) Copy this script to each control plane node, e.g. /root/fix-pki-crt-perms.sh
#   2) Run as root:  bash /root/fix-pki-crt-perms.sh
#   3) Safe to re-run; it is idempotent.

set -euo pipefail

PKI_DIR="/etc/kubernetes/pki"

echo "=== Kubernetes PKI certificate permissions hardening ==="
echo "Target directory: ${PKI_DIR}"
echo

# 1. Check directory exists
if [ ! -d "${PKI_DIR}" ]; then
  echo "Directory ${PKI_DIR} does not exist on this node. Nothing to do."
  exit 0
fi

# 2. Show current permissions
echo "Current permissions for *.crt under ${PKI_DIR}:"
find "${PKI_DIR}" -type f -name '*.crt' -print0 2>/dev/null | \
  xargs -0 -I{} stat -c '%n permissions=%a' {} 2>/dev/null || \
  echo "No .crt files found under ${PKI_DIR}."
echo

# 3. Apply remediation: set mode 644 on all .crt files (idempotent)
echo "Applying permissions: chmod 644 on all *.crt under ${PKI_DIR} ..."
# Only act if there are any matching files
if find "${PKI_DIR}" -type f -name '*.crt' -print -quit 2>/dev/null | grep -q .; then
  find "${PKI_DIR}" -type f -name '*.crt' -print0 2>/dev/null | \
    xargs -0 chmod 644
else
  echo "No .crt files found; skipping chmod."
fi
echo "Permissions update complete."
echo

# 4. Verification (adapted from audit command)
echo "Verification: resulting permissions for *.crt under ${PKI_DIR}:"
if find "${PKI_DIR}" -type f -name '*.crt' -print -quit 2>/dev/null | grep -q .; then
  find "${PKI_DIR}" -type f -name '*.crt' | xargs stat -c 'permissions=%a %n'
else
  echo "No .crt files found under ${PKI_DIR}."
fi

# 5. Check for non-compliant files (permissions > 644)
echo
echo "Checking for any certificate files still more permissive than 644..."
NON_COMPLIANT=$(find "${PKI_DIR}" -type f -name '*.crt' -printf '%p %m\n' 2>/dev/null | awk '$2 > 644')

if [ -n "${NON_COMPLIANT}" ]; then
  echo "WARNING: The following files remain more permissive than 644 and should be reviewed:"
  echo "${NON_COMPLIANT}"
  exit 1
else
  echo "All Kubernetes PKI certificate files under ${PKI_DIR} are now 644 or more restrictive."
fi