Ensure Kubernetes PKI Directory And File Ownership Is Root

#!/usr/bin/env bash
#
# Remediation: Ensure Kubernetes PKI directory and file ownership is root:root
# Scope: Run on every control plane node
# Idempotent: Safe to re-run; only fixes incorrect ownerships.
#

set -euo pipefail

PKI_DIR="/etc/kubernetes/pki"

echo "=== [1/3] Validating PKI directory exists: ${PKI_DIR} ==="
if [[ ! -d "${PKI_DIR}" ]]; then
  echo "ERROR: ${PKI_DIR} does not exist on this node. Are you on a control plane node?"
  exit 1
fi

echo "=== [2/3] Updating ownership to root:root (idempotent) ==="
# This will only change entries that are not already root:root.
sudo chown -R root:root "${PKI_DIR}"

echo "=== [3/3] Verifying ownership is now root:root ==="
# Show any entries that are NOT root:root; expect no output.
NON_ROOT_OWNERS=$(
  sudo find "${PKI_DIR}" -mindepth 1 -print0 \
  | xargs -0 -n1 stat -c '%n %U:%G' \
  | awk '$2 != "root" || $3 != "root"'
)

if [[ -n "${NON_ROOT_OWNERS}" ]]; then
  echo "FAIL: The following PKI files/directories are not owned by root:root:"
  echo "${NON_ROOT_OWNERS}"
  echo
  echo "Full ownership listing for troubleshooting:"
  sudo find "${PKI_DIR}" | xargs stat -c '%n %U:%G'
  exit 2
fi

echo "SUCCESS: All entries under ${PKI_DIR} are owned by root:root."
echo
echo "Audit output (for record):"
sudo find "${PKI_DIR}" | xargs stat -c '%U:%G'