Kubelet Configuration File Permissions Set To 644 Or More Restrictive

#!/usr/bin/env bash
#
# Remediates CIS OKE 3.1.3 on every worker node:
# Ensures /etc/kubernetes/kubelet-config.json permissions are 644.
#
# Usage:
#   1) Ensure you can SSH to each worker (e.g. via SSH keys).
#   2) Create a file "workers.txt" with one worker hostname/IP per line.
#   3) Run: bash fix-kubelet-config-perms.sh workers.txt
#
# This script is idempotent and safe to re-run.

set -euo pipefail

WORKER_LIST_FILE="${1:-}"

if [[ -z "$WORKER_LIST_FILE" || ! -f "$WORKER_LIST_FILE" ]]; then
  echo "Usage: $0 /path/to/workers.txt" >&2
  exit 1
fi

# Remote remediation script to run on each worker node
read -r -d '' REMOTE_SCRIPT << 'EOF'
set -euo pipefail

CONFIG_FILE="/etc/kubernetes/kubelet-config.json"

if [[ ! -e "$CONFIG_FILE" ]]; then
  echo "SKIP: $CONFIG_FILE does not exist on this node."
  exit 0
fi

# Show current permissions
CURRENT_PERMS="$(stat -c '%a' "$CONFIG_FILE")"
echo "Current permissions for $CONFIG_FILE: $CURRENT_PERMS"

# Apply remediation (idempotent)
chmod 644 "$CONFIG_FILE"

# Verify
NEW_PERMS="$(stat -c 'permissions=%a' "$CONFIG_FILE")"
echo "Post-fix: $NEW_PERMS"

if [[ "$NEW_PERMS" != "permissions=644" ]]; then
  echo "ERROR: Failed to set permissions to 644 on $CONFIG_FILE" >&2
  exit 1
fi

echo "OK: $CONFIG_FILE permissions set to 644"
EOF

while IFS= read -r NODE; do
  [[ -z "$NODE" || "$NODE" =~ ^# ]] && continue

  echo "==== Remediating node: $NODE ===="
  ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "$NODE" "bash -s" <<< "$REMOTE_SCRIPT" || {
    echo "ERROR: Remediation failed on node $NODE" >&2
  }
  echo
done < "$WORKER_LIST_FILE"