Ensure Controller Profiling Argument Is False

#!/usr/bin/env bash
#
# Disable kube-apiserver profiling by setting --profiling=false
# on every control plane node that runs the API server as a static pod.
#
# Run this on every control plane node with root privileges.

set -euo pipefail

APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"

echo "[INFO] Ensuring kube-apiserver profiling is disabled"

if [[ ! -f "${APISERVER_MANIFEST}" ]]; then
  echo "[ERROR] Manifest not found: ${APISERVER_MANIFEST}"
  echo "[ERROR] This script is intended for nodes using static pod manifests."
  exit 1
fi

# Create a backup once per day (idempotent enough for reruns)
BACKUP="${APISERVER_MANIFEST}.$(date +%F).bak"
if [[ ! -f "${BACKUP}" ]]; then
  cp "${APISERVER_MANIFEST}" "${BACKUP}"
  echo "[INFO] Backup created at ${BACKUP}"
else
  echo "[INFO] Backup for today already exists at ${BACKUP}"
fi

# Detect if an explicit --profiling flag exists
if grep -q -- '--profiling=' "${APISERVER_MANIFEST}"; then
  echo "[INFO] Existing --profiling flag found, enforcing --profiling=false"
  # Replace any value (true/false) with false, idempotently
  sed -i 's/--profiling=\(true\|false\)/--profiling=false/g' "${APISERVER_MANIFEST}"
else
  echo "[INFO] No --profiling flag found, adding --profiling=false to kube-apiserver args"
  # Add the flag under the args list for kube-apiserver
  # This assumes the manifest uses the common 'args:' list form.
  # The insertion is idempotent due to the grep check above.
  awk '
    $0 ~ /- kube-apiserver/ && seen == 0 {
      print
      seen=1
      next
    }
    seen == 1 && $0 ~ /^[[:space:]]*args:/ && added == 0 {
      print
      getline
      print
      # After first arg line, insert profiling flag with same indent as args items
      indent = gensub(/^([[:space:]]*)-.*/,"\\1","1",$0)
      print indent "- --profiling=false"
      added=1
      next
    }
    { print }
  ' "${APISERVER_MANIFEST}" > "${APISERVER_MANIFEST}.tmp"

  mv "${APISERVER_MANIFEST}.tmp" "${APISERVER_MANIFEST}"
fi

echo "[INFO] Change applied. kube-apiserver static pod will be restarted automatically by kubelet."

# Give kubelet some time to restart the pod
sleep 20

echo "[INFO] Verifying that kube-apiserver is running with --profiling=false"

# Verification: check running process flags
if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--profiling=false'; then
  if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--profiling=true'; then
    echo "[FAIL] Found both --profiling=true and --profiling=false in kube-apiserver process; manual review required."
    exit 2
  fi
  echo "[OK] kube-apiserver is running with --profiling=false on this control plane node."
  exit 0
else
  echo "[FAIL] kube-apiserver is not running with --profiling=false. Current process line(s):"
  /bin/ps -ef | grep kube-apiserver | grep -v grep || true
  echo "[HINT] Check ${APISERVER_MANIFEST} for correct args and kubelet/service health."
  exit 3
fi