Ensure Rotate Certificates Argument Is Not Set False

#!/usr/bin/env bash
# Purpose: Ensure kubelet client certificate rotation is enabled (rotateCertificates != false)
# Scope:   Run on EVERY WORKER NODE (as root). Safe to re-run.

set -euo pipefail

CONFIG_FILE="/var/lib/kubelet/config.yaml"
SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
NEED_RESTART=0

echo "[*] Ensuring kubelet rotateCertificates is enabled on this node..."

# 1. Fix kubelet config file, if present
if [ -f "$CONFIG_FILE" ]; then
  echo "[-] Found kubelet config file at $CONFIG_FILE"

  # Backup once per day
  BACKUP="${CONFIG_FILE}.$(date +%F-%H%M%S).bak"
  cp -p "$CONFIG_FILE" "$BACKUP"
  echo "    Backup created at $BACKUP"

  # If rotateCertificates is explicitly set to false, change to true
  if grep -qE '^[[:space:]]*rotateCertificates:[[:space:]]*false[[:space:]]*$' "$CONFIG_FILE"; then
    echo "    rotateCertificates: false found, changing to true"
    sed -i -E 's/^([[:space:]]*rotateCertificates:)[[:space:]]*false[[:space:]]*$/\1 true/' "$CONFIG_FILE"
    NEED_RESTART=1
  else
    # Ensure rotateCertificates: true is present if not set at all
    if ! grep -qE '^[[:space:]]*rotateCertificates:[[:space:]]*(true|false)[[:space:]]*$' "$CONFIG_FILE"; then
      echo "    rotateCertificates not set; adding rotateCertificates: true"
      # Append at end; kubelet config file is YAML, this adds a top-level key
      printf "\nrotateCertificates: true\n" >> "$CONFIG_FILE"
      NEED_RESTART=1
    else
      echo "    rotateCertificates is already not false; no change needed in config file"
    fi
  fi
else
  echo "[-] No kubelet config file at $CONFIG_FILE; skipping config.yaml changes"
fi

# 2. Fix systemd kubelet arguments if present
if [ -f "$SYSTEMD_DROPIN" ]; then
  echo "[-] Checking systemd drop-in at $SYSTEMD_DROPIN for --rotate-certificates=false"

  if grep -q -- '--rotate-certificates=false' "$SYSTEMD_DROPIN"; then
    BACKUP="${SYSTEMD_DROPIN}.$(date +%F-%H%M%S).bak"
    cp -p "$SYSTEMD_DROPIN" "$BACKUP"
    echo "    Backup created at $BACKUP"

    # Remove ONLY the --rotate-certificates=false argument (handles lists/whitespace)
    sed -i 's/--rotate-certificates=false//g' "$SYSTEMD_DROPIN"
    # Normalize multiple spaces left behind
    sed -i 's/[[:space:]]\+/ /g' "$SYSTEMD_DROPIN"
    NEED_RESTART=1
    echo "    Removed --rotate-certificates=false from kubelet systemd configuration"
  else
    echo "    No --rotate-certificates=false found in $SYSTEMD_DROPIN"
  fi
else
  echo "[-] No systemd drop-in at $SYSTEMD_DROPIN; skipping systemd arg changes"
fi

# 3. Restart kubelet if needed
if [ "$NEED_RESTART" -eq 1 ]; then
  echo "[-] Applying changes by restarting kubelet (this will restart the kubelet and may briefly affect pod scheduling on this node)..."
  systemctl daemon-reload
  systemctl restart kubelet.service
else
  echo "[-] No changes made; kubelet restart not required"
fi

# 4. Verification (as per audit command)
/bin/ps -fC kubelet || {
  echo "[!] kubelet process not found after changes" >&2
  exit 1
}

echo
echo "[*] Verification: kubelet process command line (ensure --rotate-certificates=false is absent):"
/bin/ps -fC kubelet

if [ -f "$CONFIG_FILE" ]; then
  echo
  echo "[*] Verification: rotateCertificates setting in $CONFIG_FILE:"
  grep -nE 'rotateCertificates' "$CONFIG_FILE" || echo "    (rotateCertificates not explicitly set; default applies)"
fi

echo
echo "[*] Completed. Run this script on every worker node."