Ensure That The --rotate-certificates Argument Is Not Present Or Is Set To True

sudo cp -a /var/lib/kubelet/config.yaml /var/lib/kubelet/config.yaml.bak.$(date +%s)
sudo cp -a /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf /etc/systemd/system/kubelet-args.conf.bak.$(date +%s)

sudo vi /var/lib/kubelet/config.yaml

rotateCertificates: true

sudo vi /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf

Environment="KUBELET_ARGS=... --rotate-certificates=true"

sudo systemctl daemon-reload
sudo systemctl restart kubelet

/bin/ps -fC kubelet

#!/usr/bin/env bash
#
# Enable kubelet certificate rotation on all worker nodes.
# Run on each worker node (e.g. via SSH/Ansible). Requires root.

set -euo pipefail

KUBELET_CFG_FILE="/var/lib/kubelet/config.yaml"
KUBELET_ARGS_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubelet-args.conf"

backup_file() {
  local f="$1"
  if [ -f "$f" ] && [ ! -f "${f}.bak" ]; then
    cp -p "$f" "${f}.bak"
  fi
}

ensure_rotate_cert_in_config() {
  local f="$1"

  # Create minimal config if missing
  if [ ! -f "$f" ]; then
    mkdir -p "$(dirname "$f")"
    cat > "$f" <<'EOF'
kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
rotateCertificates: true
EOF
    return
  fi

  # If key exists, set to true; else append it
  if grep -qE '^[[:space:]]*rotateCertificates:' "$f"; then
    # Replace any existing value with true (idempotent)
    sed -i -E 's/^[[:space:]]*rotateCertificates:[[:space:]]*(true|false|["'\'']?[^"'\''[:space:]]+["'\'']?).*/rotateCertificates: true/' "$f"
  else
    # Append under a reasonable place (end of file)
    printf '\nrotateCertificates: true\n' >> "$f"
  fi
}

ensure_rotate_cert_in_args() {
  local f="$1"

  [ -d "$(dirname "$f")" ] || mkdir -p "$(dirname "$f")"

  if [ ! -f "$f" ]; then
    cat > "$f" <<'EOF'
[Service]
Environment="KUBELET_ARGS=--rotate-certificates=true"
EOF
    return
  fi

  # Ensure no explicit false flag remains
  sed -i -E 's/--rotate-certificates=false//g' "$f"

  # If true already present, nothing more to do
  if grep -q -- '--rotate-certificates=true' "$f"; then
    return
  fi

  # If KUBELET_ARGS environment line exists, append the flag if not present
  if grep -q '^Environment="KUBELET_ARGS=' "$f"; then
    # Append flag safely inside the quoted string
    sed -i -E 's#^(Environment="KUBELET_ARGS=.*)"$#\1 --rotate-certificates=true"#' "$f"
  else
    # Add a new Environment line
    printf 'Environment="KUBELET_ARGS=--rotate-certificates=true"\n' >> "$f"
  fi
}

main() {
  if [ "$(id -u)" -ne 0 ]; then
    echo "This script must be run as root." >&2
    exit 1
  fi

  echo "Configuring kubelet certificate rotation on node: $(hostname)"

  # Backup files once
  backup_file "$KUBELET_CFG_FILE"
  backup_file "$KUBELET_ARGS_DROPIN"

  # Apply remediation method 1 (config file)
  ensure_rotate_cert_in_config "$KUBELET_CFG_FILE"

  # Ensure no conflicting false arg and/or explicitly set true if using args
  ensure_rotate_cert_in_args "$KUBELET_ARGS_DROPIN"

  # Reload systemd and restart kubelet to apply changes (causes kubelet restart)
  systemctl daemon-reload
  systemctl restart kubelet

  # Verification (adapted from audit command)
  echo "Verifying kubelet process flags on node: $(hostname)"
  /bin/ps -fC kubelet || {
    echo "kubelet process not found after restart." >&2
    exit 1
  }

  # Confirm that rotate-certificates flag is either absent or set to true
  if /bin/ps -fC kubelet | grep -q -- '--rotate-certificates=false'; then
    echo "Verification failed: kubelet still has --rotate-certificates=false" >&2
    exit 1
  fi

  echo "Verification passed: kubelet certificate rotation is enabled (flag absent or true)."
}

main "$@"