Kubelet Make Iptables Util Chains Argument Set To True

#!/usr/bin/env bash
#
# Purpose: Ensure kubelet runs with --make-iptables-util-chains=true
# Scope:   Run on every WORKER NODE as root
# Safe:    Idempotent; can be re-run
#

set -euo pipefail

KUBELET_DROPIN_DIR="/etc/systemd/system/kubelet.service.d"
KUBELET_DROPIN_FILE="${KUBELET_DROPIN_DIR}/00-default.conf"
REQUIRED_FLAG="--make-iptables-util-chains=true"

echo "==> Ensuring kubelet drop-in directory exists: ${KUBELET_DROPIN_DIR}"
mkdir -p "${KUBELET_DROPIN_DIR}"

if [[ ! -f "${KUBELET_DROPIN_FILE}" ]]; then
  echo "==> ${KUBELET_DROPIN_FILE} not found, creating minimal drop-in"
  cat > "${KUBELET_DROPIN_FILE}" <<'EOF'
[Service]
Environment="KUBELET_EXTRA_ARGS="
EOF
fi

echo "==> Ensuring ${REQUIRED_FLAG} is present in ${KUBELET_DROPIN_FILE}"

# Normalize existing KUBELET_EXTRA_ARGS and append flag if missing
if grep -q '^Environment="KUBELET_EXTRA_ARGS=' "${KUBELET_DROPIN_FILE}"; then
  # Extract current value
  current_line=$(grep '^Environment="KUBELET_EXTRA_ARGS=' "${KUBELET_DROPIN_FILE}")
  current_value=${current_line#Environment=\"KUBELET_EXTRA_ARGS=}
  current_value=${current_value%\"}

  # If flag is missing, append it
  if [[ "${current_value}" != *"${REQUIRED_FLAG}"* ]]; then
    new_value="${current_value} ${REQUIRED_FLAG}"
    # Collapse extra whitespace
    new_value=$(echo "${new_value}" | xargs)
    # Escape for sed
    esc_current=$(printf '%s\n' "${current_line}" | sed -e 's/[\/&]/\\&/g')
    esc_new=$(printf '%s\n' "Environment=\"KUBELET_EXTRA_ARGS=${new_value}\"" | sed -e 's/[\/&]/\\&/g')
    sed -i "s/${esc_current}/${esc_new}/" "${KUBELET_DROPIN_FILE}"
    echo "   - Updated KUBELET_EXTRA_ARGS to include ${REQUIRED_FLAG}"
  else
    echo "   - ${REQUIRED_FLAG} already present; no change needed"
  fi
else
  # No KUBELET_EXTRA_ARGS line; add one under [Service]
  echo "   - Adding KUBELET_EXTRA_ARGS line with ${REQUIRED_FLAG}"
  awk -v flag="${REQUIRED_FLAG}" '
    /^\[Service\]/ {
      print;
      print "Environment=\"KUBELET_EXTRA_ARGS=" flag "\"";
      next
    }
    { print }
  ' "${KUBELET_DROPIN_FILE}" > "${KUBELET_DROPIN_FILE}.tmp"
  mv "${KUBELET_DROPIN_FILE}.tmp" "${KUBELET_DROPIN_FILE}"
fi

echo "==> Reloading systemd and restarting kubelet (this will restart kubelet on this node)"
systemctl daemon-reload
systemctl restart kubelet.service

echo "==> Checking kubelet status"
systemctl status kubelet -l --no-pager || true

echo "==> Verifying kubelet process flags"
/bin/ps -fC kubelet || {
  echo "ERROR: kubelet process not found after restart" >&2
  exit 1
}

if /bin/ps -fC kubelet | grep -q -- "${REQUIRED_FLAG}"; then
  echo "SUCCESS: kubelet is running with ${REQUIRED_FLAG}"
  exit 0
else
  echo "ERROR: kubelet is NOT running with ${REQUIRED_FLAG}" >&2
  /bin/ps -fC kubelet
  exit 1
fi