Ensure Encryption Provider Config Argument Is Appropriate

#!/usr/bin/env bash
#
# Automation: Configure --encryption-provider-config on kube-apiserver
#
# Run on: every control plane node (as root)
# Usage: sudo ./configure-apiserver-encryption.sh
#
# This script:
#   - Creates an EncryptionConfig file if missing (simple aes-gcm key)
#   - Binds it into the kube-apiserver static pod if not already present
#   - Adds/updates --encryption-provider-config flag
#   - Is idempotent and safe to re-run
#   - Verifies kube-apiserver is running with the flag set
#
# NOTE: Editing /etc/kubernetes/manifests/kube-apiserver.yaml will restart the
#       kube-apiserver static pod automatically via kubelet.

set -euo pipefail

APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
ENCRYPTION_CONFIG_PATH="/etc/kubernetes/pki/encryption-config.yaml"
BACKUP_SUFFIX="$(date +%Y%m%d%H%M%S)"

# ---------- helper functions ----------

backup_file() {
  local file="$1"

  if [ ! -f "$file" ]; then
    echo "ERROR: Required file not found: $file" >&2
    exit 1
  fi

  # Only back up once per run; keep original if already backed up earlier
  local backup="${file}.bak.${BACKUP_SUFFIX}"
  cp -p "$file" "$backup"
  echo "Backup created: $backup"
}

ensure_dir() {
  local dir="$1"
  if [ ! -d "$dir" ]; then
    mkdir -p "$dir"
    chmod 0700 "$dir"
  fi
}

# Generate a random 32-byte base64 key (deterministic per run, but safe)
generate_encryption_key() {
  openssl rand -base64 32
}

# ---------- 1. Create EncryptionConfig file if missing ----------

create_encryption_config_if_missing() {
  if [ -f "$ENCRYPTION_CONFIG_PATH" ]; then
    echo "EncryptionConfig already exists at $ENCRYPTION_CONFIG_PATH; leaving as is."
    return 0
  fi

  echo "Creating new EncryptionConfig at $ENCRYPTION_CONFIG_PATH"

  ensure_dir "$(dirname "$ENCRYPTION_CONFIG_PATH")"

  local key
  key="$(generate_encryption_key)"

  cat > "$ENCRYPTION_CONFIG_PATH" <<EOF
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
      - configmaps
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: ${key}
      - identity: {}
EOF

  chmod 0600 "$ENCRYPTION_CONFIG_PATH"
  echo "EncryptionConfig created with aes-cbc provider for secrets and configmaps."
}

# ---------- 2. Ensure volume & volumeMount for EncryptionConfig ----------

ensure_apiserver_volume_and_mount() {
  local manifest="$APISERVER_MANIFEST"
  local vol_name="encryption-config"
  local vol_mount_path
  vol_mount_path="$(dirname "$ENCRYPTION_CONFIG_PATH")"

  # Ensure volume definition exists
  if grep -q "name: ${vol_name}" "$manifest"; then
    echo "Volume '${vol_name}' already defined in kube-apiserver manifest."
  else
    echo "Adding volume '${vol_name}' to kube-apiserver manifest."
    backup_file "$manifest"

    # Insert under 'volumes:'; if not found, append at end
    if grep -qE '^[[:space:]]*volumes:' "$manifest"; then
      # Append a new volume entry after the 'volumes:' line
      awk -v VNAME="$vol_name" -v VPATH="$vol_mount_path" '
        BEGIN {added=0}
        /^[[:space:]]*volumes:/ {
          print
          print "    - name: " VNAME
          print "      hostPath:"
          print "        path: " VPATH
          print "        type: DirectoryOrCreate"
          added=1
          next
        }
        {print}
        END {
          if (added == 0) {
            # If volumes: section not matched above (edge case)
            print "volumes:"
            print "  - name: " VNAME
            print "    hostPath:"
            print "      path: " VPATH
            print "      type: DirectoryOrCreate"
          }
        }
      ' "$manifest" > "${manifest}.tmp" && mv "${manifest}.tmp" "$manifest"
    else
      # No volumes: section at all; append a minimal one
      {
        cat "$manifest"
        echo ""
        echo "volumes:"
        echo "  - name: ${vol_name}"
        echo "    hostPath:"
        echo "      path: ${vol_mount_path}"
        echo "      type: DirectoryOrCreate"
      } > "${manifest}.tmp"
      mv "${manifest}.tmp" "$manifest"
    fi
  fi

  # Ensure volumeMount exists in container spec
  if grep -q "mountPath: ${vol_mount_path}" "$manifest"; then
    echo "VolumeMount for '${vol_name}' at '${vol_mount_path}' already present."
  else
    echo "Adding volumeMount for '${vol_name}' to kube-apiserver container."
    backup_file "$manifest"

    # Insert under 'volumeMounts:' for the kube-apiserver container
    awk -v VNAME="$vol_name" -v VPATH="$vol_mount_path" '
      BEGIN {inContainer=0; inVolumeMounts=0; added=0}
      /name: kube-apiserver/ && $1 ~ /name:/ {
        print
        inContainer=1
        next
      }
      inContainer == 1 && /^[[:space:]]*volumeMounts:/ {
        print
        print "        - mountPath: " VPATH
        print "          name: " VNAME
        print "          readOnly: true"
        inVolumeMounts=1
        added=1
        next
      }
      inContainer == 1 && inVolumeMounts == 0 && /^[[:space:]]*- command:/ {
        # No volumeMounts section; insert one before command
        print "      volumeMounts:"
        print "        - mountPath: " VPATH
        print "          name: " VNAME
        print "          readOnly: true"
        inVolumeMounts=1
        added=1
        print
        next
      }
      inContainer == 1 && /^[[:space:]]*image:/ {
        # End of container header without volumeMounts; add before image
        if (added == 0) {
          print "      volumeMounts:"
          print "        - mountPath: " VPATH
          print "          name: " VNAME
          print "          readOnly: true"
          added=1
        }
        print
        next
      }
      /^[[:space:]]*-/ && !/name: kube-apiserver/ && inContainer==1 {
        # Start of another container; stop container context
        inContainer=0
      }
      {print}
    ' "$manifest" > "${manifest}.tmp" && mv "${manifest}.tmp" "$manifest"
  fi
}

# ---------- 3. Ensure --encryption-provider-config flag ----------

ensure_encryption_flag() {
  local manifest="$APISERVER_MANIFEST"
  local flag="--encryption-provider-config=${ENCRYPTION_CONFIG_PATH}"

  if grep -q -- "$flag" "$manifest"; then
    echo "kube-apiserver manifest already contains ${flag}"
    return 0
  fi

  echo "Adding/updating ${flag} in kube-apiserver manifest."
  backup_file "$manifest"

  # If an old encryption-provider-config is present, replace it
  if grep -q -- "--encryption-provider-config=" "$manifest"; then
    sed -E "s#--encryption-provider-config=[^[:space:]]*#${flag}#g" \
      "$manifest" > "${manifest}.tmp"
    mv "${manifest}.tmp" "$manifest"
    return 0
  fi

  # Otherwise, add it into the existing command list
  awk -v FLAG="$flag" '
    BEGIN {inContainer=0; inCommand=0; added=0}
    /name: kube-apiserver/ && $1 ~ /name:/ {
      print
      inContainer=1
      next
    }
    inContainer == 1 && /^[[:space:]]*command:/ {
      print
      inCommand=1
      next
    }
    inContainer == 1 && inCommand == 1 && /^[[:space:]]*-/ {
      # Append flag after the last existing command entry
      lastLine=$0
      # Look ahead: if next non-empty non-comment line is still a command item, just print
      # We handle after the loop by appending FLAG as a new item if not added.
      print
      next
    }
    inContainer == 1 && inCommand == 1 && !/^[[:space:]]*-/ {
      # command list ended; insert FLAG before this line
      if (added == 0) {
        print "    - " FLAG
        added=1
      }
      inCommand=0
      print
      next
    }
    /^[[:space:]]*-/ && !/name: kube-apiserver/ && inContainer==1 {
      inContainer=0
    }
    {print}
    END {
      if (inCommand == 1 && added == 0) {
        # command block hit EOF; append FLAG as a new item
        print "    - " FLAG
      }
    }
  ' "$manifest" > "${manifest}.tmp" && mv "${manifest}.tmp" "$manifest"
}

# ---------- 4. Main ----------

if [ "$(id -u)" -ne 0 ]; then
  echo "ERROR: This script must be run as root." >&2
  exit 1
fi

if [ ! -f "$APISERVER_MANIFEST" ]; then
  echo "ERROR: kube-apiserver manifest not found at $APISERVER_MANIFEST" >&2
  exit 1
fi

create_encryption_config_if_missing
ensure_apiserver_volume_and_mount
ensure_encryption_flag

echo "Changes applied. kubelet will automatically restart kube-apiserver static pod if manifest changed."
echo "Waiting 30 seconds for kube-apiserver to restart (if needed)..."
sleep 30

# ---------- 5. Verification ----------

echo "Verification: checking kube-apiserver process for --encryption-provider-config flag"
if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--encryption-provider-config=${ENCRYPTION_CONFIG_PATH}"; then
  echo "SUCCESS: kube-apiserver is running with --encryption-provider-config=${ENCRYPTION_CONFIG_PATH}"
  exit 0
else
  echo "WARNING: kube-apiserver process does not yet show --encryption-provider-config=${ENCRYPTION_CONFIG_PATH}" >&2
  echo "Run the following manually to inspect the current process:"
  echo "  /bin/ps -ef | grep kube-apiserver | grep -v grep"
  exit 1
fi