Kubelet Read Only Port Argument Set To 0

#!/usr/bin/env bash
#
# Remediation: Ensure kubelet --read-only-port is set to 0 via systemd drop-in
# Scope: Run on every worker node (as root)
# Idempotent: Safe to re-run

set -euo pipefail

KUBELET_DROPIN_DIR="/etc/systemd/system/kubelet.service.d"
KUBELET_DROPIN_FILE="${KUBELET_DROPIN_DIR}/00-default.conf"
BACKUP_SUFFIX=".pre-readonly-port-0.$(date +%Y%m%d%H%M%S)"

echo "[INFO] Ensuring kubelet --read-only-port=0 on this node"

if [[ ! -d "${KUBELET_DROPIN_DIR}" ]]; then
  echo "[ERROR] ${KUBELET_DROPIN_DIR} does not exist. Is kubelet managed by systemd on this node?"
  exit 1
fi

if [[ ! -f "${KUBELET_DROPIN_FILE}" ]]; then
  echo "[WARN] ${KUBELET_DROPIN_FILE} not found, creating a new drop-in."
  cat > "${KUBELET_DROPIN_FILE}" <<'EOF'
[Service]
Environment="KUBELET_EXTRA_ARGS=--read-only-port=0"
EOF
else
  echo "[INFO] Updating ${KUBELET_DROPIN_FILE} to enforce --read-only-port=0"

  cp "${KUBELET_DROPIN_FILE}" "${KUBELET_DROPIN_FILE}${BACKUP_SUFFIX}"

  # If KUBELET_EXTRA_ARGS is present, ensure it contains --read-only-port=0
  if grep -q '^Environment="KUBELET_EXTRA_ARGS=' "${KUBELET_DROPIN_FILE}"; then
    # Remove any existing read-only-port settings, then append correct one
    tmp_file="$(mktemp)"
    sed -E 's/--read-only-port=[0-9]+//g' "${KUBELET_DROPIN_FILE}" > "${tmp_file}"

    # Ensure we don't end up with multiple spaces
    sed -i 's/  */ /g' "${tmp_file}"

    # Append flag inside the Environment="KUBELET_EXTRA_ARGS=..." line
    awk '
      /^Environment="KUBELET_EXTRA_ARGS=/ {
        sub(/"$/, " --read-only-port=0\"")
      }
      { print }
    ' "${tmp_file}" > "${KUBELET_DROPIN_FILE}"
    rm -f "${tmp_file}"
  else
    # No KUBELET_EXTRA_ARGS line; add one
    echo 'Environment="KUBELET_EXTRA_ARGS=--read-only-port=0"' >> "${KUBELET_DROPIN_FILE}"
  fi
fi

echo "[INFO] Reloading systemd and restarting kubelet (this will restart kubelet on this node)"

systemctl daemon-reload
systemctl restart kubelet.service

echo "[INFO] kubelet status:"
systemctl status kubelet -l --no-pager || true

echo "[INFO] Verifying kubelet is running with --read-only-port=0"
if /bin/ps -fC kubelet | grep -q -- '--read-only-port=0'; then
  if /bin/ps -fC kubelet | grep -E -- '--read-only-port=[1-9]'; then
    echo "[FAIL] Conflicting --read-only-port flag values detected in kubelet process:"
    /bin/ps -fC kubelet
    exit 1
  fi
  echo "[PASS] kubelet is configured with --read-only-port=0 on this node."
else
  echo "[FAIL] kubelet is not running with --read-only-port=0. Current kubelet command line:"
  /bin/ps -fC kubelet || true
  exit 1
fi