Kubelet Client CA File Argument Set As Appropriate

#!/usr/bin/env bash
#
# Remediates CIS OKE 3.2.3:
# Ensure kubelet is started with --client-ca-file=/etc/kubernetes/ca.crt
#
# Run on: every worker node (as root)
# Safe to re-run (idempotent).

set -euo pipefail

KUBELET_DROPIN_DIR="/etc/systemd/system/kubelet.service.d"
KUBELET_DROPIN_FILE="${KUBELET_DROPIN_DIR}/00-default.conf"
CLIENT_CA_ARG="--client-ca-file=/etc/kubernetes/ca.crt"
CA_FILE="/etc/kubernetes/ca.crt"

echo "[INFO] Starting kubelet --client-ca-file remediation"

if [[ "$(id -u)" -ne 0 ]]; then
  echo "[ERROR] This script must be run as root."
  exit 1
fi

if [[ ! -f "${KUBELET_DROPIN_FILE}" ]]; then
  echo "[ERROR] ${KUBELET_DROPIN_FILE} not found. Adjust path or create drop-in as per your distro."
  exit 1
fi

if [[ ! -f "${CA_FILE}" ]]; then
  echo "[ERROR] ${CA_FILE} not found. Create or place the correct client CA certificate before rerunning."
  exit 1
fi

echo "[INFO] Ensuring kubelet drop-in directory exists: ${KUBELET_DROPIN_DIR}"
mkdir -p "${KUBELET_DROPIN_DIR}"

echo "[INFO] Ensuring ${KUBELET_DROPIN_FILE} contains ${CLIENT_CA_ARG}"

# Backup once
if [[ ! -f "${KUBELET_DROPIN_FILE}.cis-3.2.3.bak" ]]; then
  cp "${KUBELET_DROPIN_FILE}" "${KUBELET_DROPIN_FILE}.cis-3.2.3.bak"
fi

# Normalize file and ensure Environment line with KUBELET_EXTRA_ARGS includes the arg
tmpfile="$(mktemp)"
trap 'rm -f "${tmpfile}"' EXIT

# Read current content
cat "${KUBELET_DROPIN_FILE}" > "${tmpfile}"

# Remove any duplicate --client-ca-file arguments
sed -i 's/--client-ca-file=[^ ]*//g' "${tmpfile}"

# Ensure there is an Environment line for KUBELET_EXTRA_ARGS
if ! grep -q 'Environment=.*KUBELET_EXTRA_ARGS' "${tmpfile}"; then
  # Add a basic Environment line; adapt if your distro uses a different pattern
  echo 'Environment="KUBELET_EXTRA_ARGS="' >> "${tmpfile}"
fi

# Append the CLIENT_CA_ARG to KUBELET_EXTRA_ARGS, preserving existing content
# Works whether Environment= or EnvironmentContains double quotes
perl -pi -e '
  if (/^Environment=.*KUBELET_EXTRA_ARGS/) {
    s/"$/ '"${CLIENT_CA_ARG}"'"/ if ! /'"${CLIENT_CA_ARG//\//\\/}"'/;
  }
' "${tmpfile}"

# Install updated file if changed
if ! cmp -s "${tmpfile}" "${KUBELET_DROPIN_FILE}"; then
  echo "[INFO] Updating ${KUBELET_DROPIN_FILE}"
  cp "${tmpfile}" "${KUBELET_DROPIN_FILE}"
else
  echo "[INFO] ${KUBELET_DROPIN_FILE} already contains ${CLIENT_CA_ARG}"
fi

echo "[INFO] Reloading systemd and restarting kubelet (this will restart the kubelet on this node)"
systemctl daemon-reload
systemctl restart kubelet.service

echo "[INFO] Checking kubelet status"
systemctl status kubelet -l --no-pager || true

echo "[INFO] Verifying kubelet is running with ${CLIENT_CA_ARG}"
if /bin/ps -fC kubelet | grep -q -- "${CLIENT_CA_ARG}"; then
  echo "[SUCCESS] kubelet is running with ${CLIENT_CA_ARG}"
else
  echo "[FAIL] kubelet is NOT running with ${CLIENT_CA_ARG}"
  echo "[INFO] Full kubelet command line:"
  /bin/ps -fC kubelet || true
  exit 2
fi