Ensure Bind Address Argument Is 127.0.0.1

#!/usr/bin/env bash
#
# Automation: Ensure kube-scheduler --bind-address is set to 127.0.0.1
#
# Run on: every control plane node (with root privileges).
# Effect: Editing /etc/kubernetes/manifests/kube-scheduler.yaml will
#         trigger a restart of the kube-scheduler static pod via kubelet.

set -euo pipefail

SCHEDULER_MANIFEST="/etc/kubernetes/manifests/kube-scheduler.yaml"
TMP_MANIFEST="/tmp/kube-scheduler.yaml.$$"

echo "[*] Checking for kube-scheduler manifest at ${SCHEDULER_MANIFEST}"
if [[ ! -f "${SCHEDULER_MANIFEST}" ]]; then
  echo "[!] kube-scheduler manifest not found at ${SCHEDULER_MANIFEST}. Nothing to do on this node."
  exit 0
fi

cp "${SCHEDULER_MANIFEST}" "${TMP_MANIFEST}"

echo "[*] Ensuring --bind-address=127.0.0.1 is present and correct in kube-scheduler manifest"

# Normalize any existing --bind-address argument to 127.0.0.1 inside the manifest
# Works whether the arg is formatted with or without quotes.
perl -pi -e '
  if (/--bind-address=/) {
    s/--bind-address=\S+/--bind-address=127.0.0.1/;
  }
' "${TMP_MANIFEST}"

# If no --bind-address arg exists, add it explicitly to the command args list.
# This assumes a standard static pod manifest structure.
if ! grep -q -- "--bind-address=127.0.0.1" "${TMP_MANIFEST}"; then
  echo "[*] --bind-address not found; adding --bind-address=127.0.0.1 to kube-scheduler args"

  # Try to inject into an existing args list (YAML array form).
  if grep -q '^\s*args:\s*$' "${TMP_MANIFEST}"; then
    perl -0pi -e '
      s/(^\s*args:\s*\n)((\s*-\s+.*\n)+)/$1$2\ \ - --bind-address=127.0.0.1\n/m
    ' "${TMP_MANIFEST}" || true
  fi

  # If still not present, try to append as a standalone command argument
  if ! grep -q -- "--bind-address=127.0.0.1" "${TMP_MANIFEST}"; then
    # Fallback: append to the command array if present
    perl -0pi -e '
      s/(^\s*command:\s*\n)((\s*-\s+.*\n)+)/$1$2\ \ - --bind-address=127.0.0.1\n/m
    ' "${TMP_MANIFEST}" || true
  fi
fi

# Final safety check before overwriting
if ! grep -q -- "--bind-address=127.0.0.1" "${TMP_MANIFEST}"; then
  echo "[!] Failed to ensure --bind-address=127.0.0.1 in temporary manifest. Not modifying live manifest."
  rm -f "${TMP_MANIFEST}"
  exit 1
fi

echo "[*] Updating ${SCHEDULER_MANIFEST} (this will restart the kube-scheduler static pod)"
cp "${TMP_MANIFEST}" "${SCHEDULER_MANIFEST}"
chmod 600 "${SCHEDULER_MANIFEST}"
rm -f "${TMP_MANIFEST}"

echo "[*] Waiting for kube-scheduler process to restart with new arguments..."
sleep 10

echo "[*] Verification: checking kube-scheduler process arguments"
/bin/ps -ef | grep kube-scheduler | grep -v grep || {
  echo "[!] kube-scheduler process not found. Check kubelet and static pod status."
  exit 1
}

if /bin/ps -ef | grep kube-scheduler | grep -v grep | grep -q -- "--bind-address=127.0.0.1"; then
  echo "[+] kube-scheduler is running with --bind-address=127.0.0.1"
  exit 0
else
  echo "[!] kube-scheduler is NOT running with --bind-address=127.0.0.1. Please review ${SCHEDULER_MANIFEST} and kubelet logs."
  exit 1
fi