Kubelet Kubeconfig File Permissions Set To 644 Or More Restrictive

#!/usr/bin/env bash
#
# Fix CIS OKE 3.1.1: Ensure kubelet kubeconfig file permissions are 644 or more restrictive
# Target: every worker node
#
# Run this script on each worker node (e.g., via SSH, Ansible shell, or your CM tool).
# It is safe to re-run.

set -euo pipefail

KUBELET_KUBECONFIG="/var/lib/kubelet/kubeconfig"   # Affected resource from finding
LEGACY_PATH="/etc/kubernetes/kubelet.conf"         # Path used by audit example/remediation
DESIRED_MODE="644"

change_mode_if_exists() {
  local path="$1"
  if [ -e "${path}" ]; then
    current_mode="$(stat -c '%a' "${path}")" || current_mode="UNKNOWN"
    echo "Found kubelet kubeconfig at: ${path} (current mode: ${current_mode})"

    if [ "${current_mode}" != "${DESIRED_MODE}" ]; then
      echo "Setting permissions to ${DESIRED_MODE} on ${path}"
      chmod "${DESIRED_MODE}" "${path}"
    else
      echo "Permissions already ${DESIRED_MODE} on ${path}; no change needed"
    fi
  else
    echo "Path not present, skipping: ${path}"
  fi
}

echo "=== Adjusting kubelet kubeconfig permissions on this node ==="

# Handle both the finding's path and the benchmark's example path
change_mode_if_exists "${KUBELET_KUBECONFIG}"
change_mode_if_exists "${LEGACY_PATH}"

echo
echo "=== Verification ==="

if [ -e "${KUBELET_KUBECONFIG}" ]; then
  echo "Verifying ${KUBELET_KUBECONFIG}:"
  stat -c 'permissions=%a %n' "${KUBELET_KUBECONFIG}"
fi

if [ -e "${LEGACY_PATH}" ]; then
  echo "Verifying ${LEGACY_PATH}:"
  stat -c 'permissions=%a %n' "${LEGACY_PATH}"
fi

echo
echo "Expected: permissions=644 for any kubelet kubeconfig file present on this worker node."