Ensure Clusters Are Created With Private Nodes

#!/usr/bin/env bash
#
# Report EKS cluster endpoint and node IP exposure
# Requirements:
#   - aws CLI configured with permissions to describe EKS clusters
#   - kubectl configured for each target cluster context
#   - jq installed
#
# Usage:
#   ./eks_private_nodes_report.sh               # use all kubecontexts
#   KUBECONFIG=/path/to/kubeconfig ./eks_private_nodes_report.sh

set -euo pipefail

if ! command -v aws >/dev/null 2>&1; then
  echo "ERROR: aws CLI not found in PATH" >&2
  exit 1
fi

if ! command -v kubectl >/dev/null 2>&1; then
  echo "ERROR: kubectl not found in PATH" >&2
  exit 1
fi

if ! command -v jq >/dev/null 2>&1; then
  echo "ERROR: jq not found in PATH" >&2
  exit 1
fi

contexts=$(kubectl config get-contexts -o name 2>/dev/null || true)
if [ -z "${contexts}" ]; then
  echo "No kubectl contexts found."
  exit 0
fi

echo "Cluster,Context,AWS_Region,ControlPlaneEndpointPublicAccess,ControlPlaneEndpointPrivateAccess,PublicAccessCidrs,AnyNodeHasPublicIP,NodeDetails"

for ctx in $contexts; do
  # Switch context
  kubectl config use-context "$ctx" >/dev/null

  # Try to infer EKS cluster name and region from aws-auth ConfigMap and/or ARN
  cluster_name=""
  region=""

  # First, try cluster-info (EKS ARNs usually contain cluster name)
  server_url=$(kubectl cluster-info | awk '/is running at/ {print $NF}' | head -n1 || true)
  # Example EKS endpoint: https://XXXXXXXX.gr7.us-west-2.eks.amazonaws.com
  if [[ "$server_url" =~ eks\.amazonaws\.com ]]; then
    host=$(printf "%s" "$server_url" | sed -E 's@https?://([^/]+)/?.*@\1@')
    # region is the 3rd label from the right for EKS endpoints: xxxxx.region.eks.amazonaws.com
    region=$(printf "%s" "$host" | awk -F. '{print $(NF-2)"-"$(NF-1)"-"$NF}' | sed -E 's/\.eks\.amazonaws\.com$//' || true)
  fi

  # If region parsing failed, fall back to an env var AWS_REGION/AWS_DEFAULT_REGION if set
  if [ -z "$region" ]; then
    region="${AWS_REGION:-${AWS_DEFAULT_REGION:-}}"
  fi

  # Try to get cluster name from aws-auth ConfigMap (not always present)
  aws_auth_ns="kube-system"
  if kubectl get cm aws-auth -n "$aws_auth_ns" >/dev/null 2>&1; then
    # This just confirms it's an EKS-like cluster but not the EKS cluster name
    :
  fi

  # As there's no reliable way via kubectl to infer EKS cluster name, require user mapping via context name
  # Assumption: kubectl context name == EKS cluster name (common practice with aws eks update-kubeconfig)
  cluster_name="$ctx"

  eks_desc=""
  if [ -n "$cluster_name" ] && [ -n "$region" ]; then
    eks_desc=$(aws eks describe-cluster \
      --name "$cluster_name" \
      --region "$region" \
      --output json 2>/dev/null || true)
  fi

  if [ -z "$eks_desc" ]; then
    # Not an EKS cluster (or cannot describe). We still check node external IPs via kubectl.
    endpoint_public="unknown-not-eks-or-no-perms"
    endpoint_private="unknown-not-eks-or-no-perms"
    public_cidrs="unknown-not-eks-or-no-perms"
  else
    endpoint_public=$(printf "%s" "$eks_desc" | jq -r '.cluster.resourcesVpcConfig.endpointPublicAccess')
    endpoint_private=$(printf "%s" "$eks_desc" | jq -r '.cluster.resourcesVpcConfig.endpointPrivateAccess')
    public_cidrs=$(printf "%s" "$eks_desc" | jq -r '.cluster.resourcesVpcConfig.publicAccessCidrs | join(";")')
  fi

  # Gather node IP information
  # Any node having an ExternalIP is a potential problem for this control
  # (You must verify in your cloud console if those are truly public IPs and routable.)
  nodes_json=$(kubectl get nodes -o json 2>/dev/null || true)
  if [ -z "$nodes_json" ]; then
    any_node_public="no-nodes"
    node_details="no-nodes"
  else
    any_ext=$(printf "%s" "$nodes_json" | jq '[.items[].status.addresses[] | select(.type=="ExternalIP")] | length > 0')
    any_node_public="$any_ext"
    # Collect concise node/IP summary
    node_details=$(printf "%s" "$nodes_json" |
      jq -r '.items[] |
        {
          name: .metadata.name,
          internalIPs: ([.status.addresses[] | select(.type=="InternalIP") | .address] | join("|")),
          externalIPs: ([.status.addresses[] | select(.type=="ExternalIP") | .address] | join("|"))
        } |
        "\(.name):internal=\(.internalIPs),external=\(.externalIPs)"' |
        paste -sd ";" -)
    [ -z "$node_details" ] && node_details="none"
  fi

  echo "${cluster_name},${ctx},${region:-unknown},${endpoint_public},${endpoint_private},\"${public_cidrs}\",${any_node_public},\"${node_details}\""
done