Proxy Kubeconfig File Ownership Set To root:root

#!/usr/bin/env bash
# Purpose: Ensure kube-proxy kubeconfig (/etc/kubernetes/proxy.conf) is owned by root:root
# Scope:   Run on every worker node
# Usage:   sudo /usr/local/sbin/fix-kube-proxy-kubeconfig-ownership.sh

set -euo pipefail

TARGET_FILE="/etc/kubernetes/proxy.conf"

echo "==> Checking for ${TARGET_FILE}"

if [ ! -e "${TARGET_FILE}" ]; then
  echo "    File not found; nothing to do on this node."
  exit 0
fi

CURRENT_OWNER_GROUP="$(stat -c '%U:%G' "${TARGET_FILE}")"

if [ "${CURRENT_OWNER_GROUP}" = "root:root" ]; then
  echo "    Ownership already correct (root:root); no change needed."
else
  echo "    Current ownership is ${CURRENT_OWNER_GROUP}; updating to root:root"
  chown root:root "${TARGET_FILE}"
fi

echo "==> Verifying ownership"
VERIFY_OWNER_GROUP="$(stat -c '%U:%G' "${TARGET_FILE}")"

if [ "${VERIFY_OWNER_GROUP}" != "root:root" ]; then
  echo "ERROR: Failed to set ownership to root:root (current: ${VERIFY_OWNER_GROUP})" >&2
  exit 1
fi

echo "    Verified: ${TARGET_FILE} is owned by root:root"
exit 0