Ensure Anonymous Auth Argument Is Disabled

sudo vi /var/lib/kubelet/config.yaml

authentication:
  anonymous:
    enabled: false

sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

--anonymous-auth=false

sudo systemctl daemon-reload

sudo systemctl restart kubelet.service

/bin/ps -fC kubelet

#!/usr/bin/env bash
#
# Remediation: Disable anonymous auth on kubelet via /var/lib/kubelet/config.yaml
# Applies to: every worker node (run locally on each node, or via SSH/Ansible)
# Idempotent: safe to run multiple times
#

set -euo pipefail

CONFIG_FILE="/var/lib/kubelet/config.yaml"
BACKUP_SUFFIX="$(date +%Y%m%d%H%M%S)"
SYSTEMD_UNIT="kubelet.service"

echo "[INFO] Ensuring kubelet anonymous auth is disabled on this node"

if [ ! -f "$CONFIG_FILE" ]; then
  echo "[ERROR] Kubelet config file not found at $CONFIG_FILE"
  echo "[ERROR] This script expects kubelet to be configured via $CONFIG_FILE."
  echo "[ERROR] If your kubelet uses only command-line flags/systemd env, follow the Manual Steps for flag-based configuration."
  exit 1
fi

# Backup once per run
cp -p "$CONFIG_FILE" "${CONFIG_FILE}.bak.${BACKUP_SUFFIX}"
echo "[INFO] Backed up $CONFIG_FILE to ${CONFIG_FILE}.bak.${BACKUP_SUFFIX}"

# Ensure the 'authentication:' block exists
if ! grep -qE '^[[:space:]]*authentication:' "$CONFIG_FILE"; then
  cat <<'EOF' >>"$CONFIG_FILE"

authentication:
  anonymous:
    enabled: false
EOF
  echo "[INFO] Added authentication.anonymous.enabled: false block to $CONFIG_FILE"
else
  # Ensure 'anonymous:' exists under 'authentication:'
  awk '
  BEGIN { in_auth=0; anon_present=0 }
  /^[[:space:]]*authentication:[[:space:]]*$/ { in_auth=1; print; next }
  in_auth && /^[^[:space:]]/ { in_auth=0 }
  in_auth && /^[[:space:]]*anonymous:[[:space:]]*$/ { anon_present=1 }
  { print }
  END {
    if (in_auth && !anon_present) {
      print "  anonymous:"
      print "    enabled: false"
    }
  }' "$CONFIG_FILE" >"${CONFIG_FILE}.tmp"

  mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE"
  echo "[INFO] Ensured authentication.anonymous block exists in $CONFIG_FILE"

  # Now explicitly set enabled: false (handle various existing values/indentation)
  python3 - "$CONFIG_FILE" <<'PYCODE'
import sys, io
from pathlib import Path

cfg_path = Path(sys.argv[1])
data = cfg_path.read_text()

lines = data.splitlines()
out = []
in_auth = False
in_anon = False
auth_indent = None
anon_indent = None

for line in lines:
    stripped = line.lstrip()
    indent = len(line) - len(stripped)

    if stripped.startswith('authentication:'):
        in_auth = True
        auth_indent = indent
        in_anon = False
        out.append(line)
        continue

    if in_auth and indent <= (auth_indent or 0) and stripped and not stripped.startswith("#"):
        in_auth = False
        in_anon = False

    if in_auth and stripped.startswith('anonymous:'):
        in_anon = True
        anon_indent = indent
        out.append(line)
        continue

    if in_anon:
        # Leaving anonymous block?
        if stripped and indent <= (anon_indent or 0) and not stripped.startswith("#"):
            # We already ensured block exists; just end tracking here
            in_anon = False

    # Replace any "enabled:" under the anonymous block
    if in_anon and stripped.startswith('enabled:'):
        out.append(' ' * (anon_indent + 2) + 'enabled: false')
    else:
        out.append(line)

cfg_path.write_text("\n".join(out) + "\n")
PYCODE
  echo "[INFO] Set authentication.anonymous.enabled: false in $CONFIG_FILE"
fi

# Reload & restart kubelet to apply changes
echo "[INFO] Reloading systemd and restarting kubelet"
if command -v systemctl >/dev/null 2>&1; then
  systemctl daemon-reload
  systemctl restart "$SYSTEMD_UNIT"
else
  echo "[WARN] systemctl not found; please restart kubelet manually to apply changes"
fi

# Verification (same host): ensure kubelet process is running and anonymous-auth is effectively disabled
echo "[INFO] Verifying kubelet process and effective anonymous-auth setting"

/bin/ps -fC kubelet || {
  echo "[ERROR] kubelet process not found after restart"
  exit 1
}

# Best-effort config verification: print the relevant section for human review
echo "[INFO] Current authentication.anonymous section in $CONFIG_FILE:"
grep -n -A3 -B1 'authentication:' "$CONFIG_FILE" | sed -n '1,40p'

echo "[INFO] Verification step: kubelet is running. Confirm that the 'enabled' field under authentication.anonymous is set to false above."