Ensure Clusters Are Created With Private Nodes

#!/usr/bin/env bash
#
# Report whether Kubernetes nodes appear to be privately or publicly addressed.
# Run on any machine with kubectl access and KUBECONFIG set for the target cluster.

set -euo pipefail

echo "Checking node IP exposure for cluster: $(kubectl config current-context)"
echo "Timestamp: $(date -Iseconds)"
echo

# 1) List all nodes and their Internal/External IPs from the Kubernetes API
echo "=== Node IPs from Kubernetes Node objects ==="
kubectl get nodes -o json \
  | jq -r '
    .items[]
    | {
        name: .metadata.name,
        addresses: (
          .status.addresses
          | map({(.type): .address})
          | add
        )
      }
    | [
        .name,
        ( .addresses.InternalIP // "NONE" ),
        ( .addresses.ExternalIP // "NONE" )
      ]
    | @tsv
  ' \
  | awk 'BEGIN { printf "%-40s %-18s %-18s\n", "NODE", "INTERNAL_IP", "EXTERNAL_IP";
                  print "--------------------------------------------------------------------------------" }
         { printf "%-40s %-18s %-18s\n", $1, $2, $3 }'
echo

# 2) Highlight nodes that have an ExternalIP in the Kubernetes API
echo "=== Nodes with ExternalIP set (potentially PUBLICLY EXPOSED) ==="
HAS_EXTERNAL=$(kubectl get nodes -o json \
  | jq -r '
      .items[]
      | {
          name: .metadata.name,
          external: (
            .status.addresses[]
            | select(.type=="ExternalIP")
            | .address
          )
        }
      | select(.external != null)
      | [.name, .external]
      | @tsv
    ' || true)

if [ -z "$HAS_EXTERNAL" ]; then
  echo "No nodes report an ExternalIP in the Kubernetes API."
else
  printf "%-40s %-18s\n" "NODE" "EXTERNAL_IP"
  echo "--------------------------------------------------------------"
  printf '%s\n' "$HAS_EXTERNAL" \
    | awk '{ printf "%-40s %-18s\n", $1, $2 }'
fi
echo

# 3) Optional: try to infer public vs private via RFC1918 ranges
#    (This is heuristic; final determination must be done in the cloud console/IaC.)
echo "=== Heuristic: Nodes with non-RFC1918 InternalIP (suspicious) ==="
kubectl get nodes -o json \
  | jq -r '
    .items[]
    | {
        name: .metadata.name,
        addresses: (
          .status.addresses
          | map({(.type): .address})
          | add
        )
      }
    | select(.addresses.InternalIP != null)
    | select(
        (.addresses.InternalIP
          | test("^10\\.")       == false
          and test("^192\\.168\\.") == false
          and test("^172\\.(1[6-9]|2[0-9]|3[0-1])\\.") == false
        )
      )
    | [.name, .addresses.InternalIP]
    | @tsv
  ' | awk 'BEGIN {
             printf "%-40s %-18s\n", "NODE", "INTERNAL_IP (NON-RFC1918)"
             print "--------------------------------------------------------------"
           }
           { printf "%-40s %-18s\n", $1, $2 }' || true

echo
echo "INTERPRETATION:"
echo "- Any node listed in 'Nodes with ExternalIP set' must be reviewed: CIS requires nodes to"
echo "  NOT have public IPs (private nodes only). If any appear there, this is a problem."
echo "- Nodes shown under the heuristic section use non-RFC1918 InternalIP ranges and should be"
echo "  reviewed in the cloud provider console/IaC to confirm whether they are actually public."
echo
echo "Next steps (manual review required):"
echo "- In your cloud provider console or IaC, confirm that worker node groups / node pools"
echo "  are configured as private (no public IPs) and attached to private subnets only."