Kubelet Kubeconfig File Ownership Set To root:root

#!/usr/bin/env bash
#
# Fix ownership of the kubelet kubeconfig file on worker nodes
# Scope: run on every worker node (e.g., via SSH, Ansible shell, or a node startup script)
# Idempotent: safe to re-run

set -euo pipefail

# Path from the finding
KUBELET_KUBECONFIG="/var/lib/kubelet/kubeconfig"

echo "==> Checking kubelet kubeconfig at ${KUBELET_KUBECONFIG}"

if [ ! -e "${KUBELET_KUBECONFIG}" ]; then
  echo "File not found: ${KUBELET_KUBECONFIG}"
  echo "Nothing to change on this node."
  exit 0
fi

# Show current ownership
current_owner="$(stat -c '%U:%G' "${KUBELET_KUBECONFIG}")"
echo "Current ownership: ${current_owner}"

# Apply fix (idempotent: chown to same value is safe)
echo "Setting ownership to root:root ..."
chown root:root "${KUBELET_KUBECONFIG}"

# Verification
echo "Verifying ownership ..."
new_owner="$(stat -c '%U:%G' "${KUBELET_KUBECONFIG}")"
echo "New ownership: ${new_owner}"

if [ "${new_owner}" != "root:root" ]; then
  echo "ERROR: Failed to set ownership to root:root for ${KUBELET_KUBECONFIG}" >&2
  exit 1
fi

echo "Success: ${KUBELET_KUBECONFIG} is owned by root:root"

#
# Example: run across all worker nodes from a control machine
# (replace with your actual worker node hostnames/IPs and SSH options)
#
# WORKERS=("worker1" "worker2" "worker3")
# for node in "${WORKERS[@]}"; do
#   echo "=== ${node} ==="
#   scp ./fix-kubelet-kubeconfig-ownership.sh "root@${node}:/tmp/fix-kubelet-kubeconfig-ownership.sh"
#   ssh "root@${node}" "bash /tmp/fix-kubelet-kubeconfig-ownership.sh"
# done