Ensure Scheduler Pod Specification File Ownership Is Root

#!/usr/bin/env bash
#
# Fix ownership of kube-scheduler pod specification file to root:root
# Applies on: every control plane node
# Safe to re-run (idempotent)

set -euo pipefail

SCHEDULER_MANIFEST="/etc/kubernetes/manifests/kube-scheduler.yaml"

echo "==> Checking for kube-scheduler manifest at ${SCHEDULER_MANIFEST}"

if [ ! -e "${SCHEDULER_MANIFEST}" ]; then
  echo "WARNING: ${SCHEDULER_MANIFEST} not found on this node. Nothing to do."
  exit 0
fi

# Show current ownership
current_owner="$(stat -c '%U:%G' "${SCHEDULER_MANIFEST}")"
echo "Current ownership: ${current_owner}"

# Only change if not already root:root
if [ "${current_owner}" != "root:root" ]; then
  echo "Updating ownership to root:root ..."
  chown root:root "${SCHEDULER_MANIFEST}"
else
  echo "Ownership already set to root:root, no change needed."
fi

# Verification (re-run audit)
echo "==> Verifying ownership..."
verified_owner="$(stat -c '%U:%G' "${SCHEDULER_MANIFEST}")"
echo "Verified ownership: ${verified_owner}"

if [ "${verified_owner}" != "root:root" ]; then
  echo "ERROR: Failed to set ownership to root:root on ${SCHEDULER_MANIFEST}" >&2
  exit 1
fi

echo "SUCCESS: ${SCHEDULER_MANIFEST} ownership is correctly set to root:root"

sudo bash fix-kube-scheduler-ownership.sh