Kubernetes PKI Directory And File Ownership Should Be root:root

#!/usr/bin/env bash
#
# Purpose: Ensure Kubernetes PKI directory and file ownership is root:root
# Scope:   Run on every control plane node
# Usage:   sudo bash fix-k8s-pki-ownership.sh

set -euo pipefail

PKI_DIR="/etc/kubernetes/pki"

echo "=== Kubernetes PKI ownership remediation ==="
echo "Target directory: ${PKI_DIR}"
echo

# 1) Pre-checks
if [[ "$(id -u)" -ne 0 ]]; then
  echo "ERROR: This script must be run as root." >&2
  exit 1
fi

if [[ ! -d "${PKI_DIR}" ]]; then
  echo "No PKI directory found at ${PKI_DIR}. Nothing to do on this node."
  exit 0
fi

# 2) Show current ownership for visibility
echo "Current ownership (before fix):"
find "${PKI_DIR}/" -print0 | xargs -0 stat -c '%n %U:%G' | sort
echo

# 3) Apply remediation (idempotent)
echo "Applying chown -R root:root ${PKI_DIR}/ ..."
chown -R root:root "${PKI_DIR}/"
echo "Ownership change complete."
echo

# 4) Verification (authoritative audit)
echo "Verifying ownership (expected: root:root for all paths)..."
VERIFY_OUTPUT="$(find "${PKI_DIR}/" -print0 | xargs -0 stat -c '%U:%G' | sort -u)"

echo "${VERIFY_OUTPUT}"
echo

if [[ "${VERIFY_OUTPUT}" == "root:root" ]]; then
  echo "SUCCESS: All files and directories under ${PKI_DIR}/ are owned by root:root."
  exit 0
else
  echo "WARNING: Some entries under ${PKI_DIR}/ are not owned by root:root." >&2
  echo "Please review the above lines and adjust manually if required."
  exit 1
fi