Ensure Anonymous Auth Argument Is Disabled

#!/usr/bin/env bash
#
# Hardens kubelet by disabling anonymous auth via /var/lib/kubelet/config.yaml
# Applies to: every worker node
# Usage: run as root on each worker node (e.g. via SSH or a config management tool)

set -euo pipefail

CONFIG_FILE="/var/lib/kubelet/config.yaml"
BACKUP_DIR="/var/lib/kubelet/backup-$(date -u +%Y%m%dT%H%M%SZ)"
NEED_RESTART=0

echo "[INFO] Ensuring kubelet anonymous auth is disabled using ${CONFIG_FILE}"

if [[ ! -f "${CONFIG_FILE}" ]]; then
  echo "[ERROR] Kubelet config file ${CONFIG_FILE} not found. This script expects kubelet to be using a config file."
  echo "[ERROR] If your kubelet is configured only via flags, set --anonymous-auth=false in the systemd unit as per CIS guidance."
  exit 1
fi

mkdir -p "${BACKUP_DIR}"
cp -a "${CONFIG_FILE}" "${BACKUP_DIR}/config.yaml"

echo "[INFO] Backed up current config to ${BACKUP_DIR}/config.yaml"

# Ensure yq is available for safe YAML editing; install guidance if missing
if ! command -v yq >/dev/null 2>&1; then
  echo "[ERROR] This script requires 'yq' (https://mikefarah.gitbook.io/yq/) to edit YAML safely."
  echo "        Install yq on this node, then re-run the script."
  exit 1
fi

# Detect current value (if any)
CURRENT_VAL="$(yq '.authentication.anonymous.enabled // "unset"' "${CONFIG_FILE}" || echo "unset")"

if [[ "${CURRENT_VAL}" == "false" ]]; then
  echo "[INFO] authentication.anonymous.enabled is already set to false. No change needed."
else
  echo "[INFO] Setting authentication.anonymous.enabled to false (was: ${CURRENT_VAL})"
  # This creates the authentication/anonymous structure if it does not exist
  TMP_FILE="${CONFIG_FILE}.tmp.$$"
  yq '.authentication.anonymous.enabled = false' "${CONFIG_FILE}" > "${TMP_FILE}"
  mv "${TMP_FILE}" "${CONFIG_FILE}"
  NEED_RESTART=1
fi

# Restart kubelet if we changed config
if [[ "${NEED_RESTART}" -eq 1 ]]; then
  echo "[INFO] Restarting kubelet to apply configuration change"
  systemctl daemon-reload
  systemctl restart kubelet.service
  sleep 5
else
  echo "[INFO] Skipping kubelet restart; no configuration changes made."
fi

# Verification: confirm kubelet is running and anonymous-auth is effectively disabled
echo "[INFO] Verifying kubelet process is running"
if ! /bin/ps -fC kubelet >/dev/null 2>&1; then
  echo "[ERROR] kubelet process not found after restart. Check 'systemctl status kubelet' for details."
  exit 1
fi

echo "[INFO] kubelet process is running. Verifying config value:"
VERIFY_VAL="$(yq '.authentication.anonymous.enabled // "unset"' "${CONFIG_FILE}" || echo "unset")"
echo "[INFO] /var/lib/kubelet/config.yaml -> authentication.anonymous.enabled = ${VERIFY_VAL}"

if [[ "${VERIFY_VAL}" != "false" ]]; then
  echo "[ERROR] Expected authentication.anonymous.enabled=false in ${CONFIG_FILE}, but found '${VERIFY_VAL}'."
  exit 1
fi

echo "[INFO] Anonymous auth is disabled in kubelet config on this node."
echo "[INFO] To complete remediation, run this script on every worker node."