---
- name: Security | Enhance etcd node security permissions
  command: |
    chmod 700 /etc/ssl/etcd/ssl && chown root:root /etc/ssl/etcd/ssl
    chmod 600 /etc/ssl/etcd/ssl/* && chown root:root /etc/ssl/etcd/ssl/*
    chmod 700 /var/lib/etcd && chown etcd:etcd /var/lib/etcd
    chmod 550 /usr/local/bin/etcd* && chown root:root /usr/local/bin/etcd*
  when: .groups.etcd | default list | has .inventory_hostname

- name: Security | Apply security best practices for control plane nodes
  command: |
    chmod 644 /etc/kubernetes && chown root:root /etc/kubernetes
    chmod 600 -R /etc/kubernetes && chown root:root -R /etc/kubernetes/*
    chmod 644 /etc/kubernetes/manifests && chown root:root /etc/kubernetes/manifests
    chmod 644 /etc/kubernetes/pki && chown root:root /etc/kubernetes/pki
    chmod 600 -R /etc/cni/net.d && chown root:root -R /etc/cni/net.d
    chmod 550 /usr/local/bin/ && chown root:root /usr/local/bin/
    chmod 550 -R /usr/local/bin/kube* && chown root:root -R /usr/local/bin/kube*
    chmod 550 /usr/local/bin/helm && chown root:root /usr/local/bin/helm
    chmod 550 -R /opt/cni/bin && chown root:root -R /opt/cni/bin
    chmod 640 /var/lib/kubelet/config.yaml && chown root:root /var/lib/kubelet/config.yaml
    chmod 640 -R /etc/systemd/system/kubelet.service* && chown root:root -R /etc/systemd/system/kubelet.service*
    chmod 640 /etc/systemd/system/k8s-certs-renew* && chown root:root /etc/systemd/system/k8s-certs-renew*
  when: .groups.kube_control_plane | default list | has .inventory_hostname

- name: Security | Apply security best practices for worker nodes
  command: |
    chmod 644 /etc/kubernetes && chown root:root /etc/kubernetes
    chmod 600 -R /etc/kubernetes && chown root:root -R /etc/kubernetes/*
    chmod 644 /etc/kubernetes/manifests && chown root:root /etc/kubernetes/manifests
    chmod 644 /etc/kubernetes/pki && chown root:root /etc/kubernetes/pki
    chmod 600 -R /etc/cni/net.d && chown root:root -R /etc/cni/net.d
    chmod 550 /usr/local/bin/ && chown root:root /usr/local/bin/
    chmod 550 -R /usr/local/bin/kube* && chown root:root -R /usr/local/bin/kube*
    chmod 550 /usr/local/bin/helm && chown root:root /usr/local/bin/helm
    chmod 550 -R /opt/cni/bin && chown root:root -R /opt/cni/bin
    chmod 640 /var/lib/kubelet/config.yaml && chown root:root /var/lib/kubelet/config.yaml
    chmod 640 -R /etc/systemd/system/kubelet.service* && chown root:root -R /etc/systemd/system/kubelet.service*
  when: .groups.kube_worker | default list | has .inventory_hostname
