Ensure Protect Kernel Defaults Argument Is Enabled

#!/usr/bin/env bash
#
# Enable protectKernelDefaults for kubelet on each worker node.
# Run this on every worker node as root.
# Safe to re-run; it will only adjust config if needed.
set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"

echo "[*] Ensuring kubelet protectKernelDefaults is enabled..."

fix_config_file() {
  if [ ! -f "$KUBELET_CONFIG" ]; then
    echo "[-] $KUBELET_CONFIG not found; skipping file-based configuration."
    return
  fi

  if ! command -v python3 >/dev/null 2>&1; then
    echo "[-] python3 is required for safe YAML editing; please install it."
    return 1
  fi

  echo "[*] Updating $KUBELET_CONFIG (if needed)..."
  python3 << 'PYEOF'
import sys
from pathlib import Path

cfg_path = Path("/var/lib/kubelet/config.yaml")
data = cfg_path.read_text()

# Minimal, structure-preserving update: ensure a top-level line
# 'protectKernelDefaults: true' exists and is set to true.
lines = data.splitlines()
out = []
found = False
for line in lines:
    if line.lstrip().startswith("protectKernelDefaults:"):
        # Normalize to 'protectKernelDefaults: true'
        indent = line[:len(line) - len(line.lstrip())]
        out.append(f"{indent}protectKernelDefaults: true")
        found = True
    else:
        out.append(line)

if not found:
    # Append at end as a top‑level key
    if out and out[-1].strip() != "":
        out.append("")
    out.append("protectKernelDefaults: true")

new_data = "\n".join(out) + ("\n" if not out or not out[-1].endswith("\n") else "")
if new_data != data:
    cfg_path.write_text(new_data)
PYEOF
}

fix_systemd_dropin() {
  if [ ! -f "$SYSTEMD_DROPIN" ]; then
    echo "[-] $SYSTEMD_DROPIN not found; skipping systemd flag-based configuration."
    return
  fi

  echo "[*] Ensuring --protect-kernel-defaults=true is present in $SYSTEMD_DROPIN..."

  # Ensure the KUBELET_SYSTEM_PODS_ARGS variable exists and contains the flag.
  if ! grep -q '^Environment="KUBELET_SYSTEM_PODS_ARGS=' "$SYSTEMD_DROPIN"; then
    # Add a new Environment line with the flag
    echo 'Environment="KUBELET_SYSTEM_PODS_ARGS=--protect-kernel-defaults=true"' >> "$SYSTEMD_DROPIN"
  else
    # Update existing line to include the flag exactly once
    tmp="$(mktemp)"
    awk '
      /^Environment="KUBELET_SYSTEM_PODS_ARGS=/ {
        line=$0
        sub(/^Environment="KUBELET_SYSTEM_PODS_ARGS=/,"",line)
        sub(/"$/,"",line)
        args=line
        has_flag=0
        n=split(args, a, " ")
        out=""
        for (i=1;i<=n;i++) {
          if (a[i] == "--protect-kernel-defaults=true") has_flag=1
          if (a[i] != "") {
            if (out=="") out=a[i]; else out=out" "a[i]
          }
        }
        if (!has_flag) {
          if (out=="") out="--protect-kernel-defaults=true"
          else out=out" --protect-kernel-defaults=true"
        }
        print "Environment=\"KUBELET_SYSTEM_PODS_ARGS=" out "\""
        next
      }
      { print }
    ' "$SYSTEMD_DROPIN" > "$tmp"
    mv "$tmp" "$SYSTEMD_DROPIN"
  fi
}

# Apply fixes
fix_config_file || true
fix_systemd_dropin || true

echo "[*] Reloading systemd and restarting kubelet..."
systemctl daemon-reload
systemctl restart kubelet.service

echo "[*] Verification: checking kubelet process arguments and config..."
/bin/ps -fC kubelet || { echo "[-] kubelet process not found"; exit 1; }

# Confirm the flag is set on the process OR in the config file
if /bin/ps -fC kubelet | grep -q -- '--protect-kernel-defaults=true'; then
  echo "[+] kubelet is running with --protect-kernel-defaults=true"
else
  echo "[*] --protect-kernel-defaults flag not visible in process args; checking config file..."
  if [ -f "$KUBELET_CONFIG" ] && grep -q '^[[:space:]]*protectKernelDefaults:[[:space:]]*true' "$KUBELET_CONFIG"; then
    echo "[+] protectKernelDefaults: true is set in $KUBELET_CONFIG"
  else
    echo "[-] protectKernelDefaults is not confirmed as enabled; manual review required."
    exit 1
  fi
fi

echo "[*] Done."