Ensure Make Iptables Util Chains Argument Is Enabled

#!/usr/bin/env bash
#
# Remediation: Ensure Kubelet makeIPTablesUtilChains is enabled (CIS 4.2.7)
# Target: EVERY WORKER NODE (run this script on each worker node as root)
#
# Behavior:
# - Ensures /var/lib/kubelet/config.yaml exists and has makeIPTablesUtilChains: true
# - Removes any explicit --make-iptables-util-chains flag from kubelet systemd drop-ins
# - Reloads systemd and restarts kubelet only if a change was made
# - Verifies that kubelet is running with makeIPTablesUtilChains enabled
#
# Safe to re-run: yes (idempotent)

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
SYSTEMD_DIR="/etc/systemd/system"
CHANGED=0

echo "[INFO] Running on worker node: $(hostname)"

#############################################
# Step 1: Ensure Kubelet config file exists
#############################################
if [ ! -f "${KUBELET_CONFIG}" ]; then
  echo "[INFO] ${KUBELET_CONFIG} not found, creating minimal config file"
  install -m 600 -o root -g root /dev/null "${KUBELET_CONFIG}"
  cat > "${KUBELET_CONFIG}" <<'EOF'
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
makeIPTablesUtilChains: true
EOF
  CHANGED=1
else
  echo "[INFO] ${KUBELET_CONFIG} exists, ensuring makeIPTablesUtilChains: true"

  # If key is present, set to true; if absent, append.
  if grep -Eq '^\s*makeIPTablesUtilChains\s*:' "${KUBELET_CONFIG}"; then
    if ! grep -Eq '^\s*makeIPTablesUtilChains\s*:\s*true\s*($|#)' "${KUBELET_CONFIG}"; then
      echo "[INFO] Updating existing makeIPTablesUtilChains entry to true"
      # In-place edit: set any value to true
      sed -Ei 's/^\s*makeIPTablesUtilChains\s*:.*/makeIPTablesUtilChains: true/' "${KUBELET_CONFIG}"
      CHANGED=1
    else
      echo "[INFO] makeIPTablesUtilChains already set to true in config file"
    fi
  else
    echo "[INFO] Adding makeIPTablesUtilChains: true to ${KUBELET_CONFIG}"
    printf '\nmakeIPTablesUtilChains: true\n' >> "${KUBELET_CONFIG}"
    CHANGED=1
  fi
fi

#######################################################
# Step 2: Remove CLI flag --make-iptables-util-chains
#######################################################
echo "[INFO] Checking for CLI flags in systemd units"

# Process all kubelet-related systemd unit files and drop-ins
mapfile -t UNIT_FILES < <(grep -rl --exclude-dir='*.wants' 'kubelet' "${SYSTEMD_DIR}" 2>/dev/null | sort -u || true)

for f in "${UNIT_FILES[@]}"; do
  if grep -q -- '--make-iptables-util-chains' "$f"; then
    echo "[INFO] Removing --make-iptables-util-chains from ${f}"
    # Remove occurrences of the flag safely, including optional value
    sed -Ei 's/--make-iptables-util-chains(=[^[:space:]]*)?//g' "$f"
    # Normalize multiple spaces
    sed -Ei 's/[[:space:]]+/ /g' "$f"
    CHANGED=1
  fi
done

#############################################
# Step 3: Reload systemd and restart kubelet
#############################################
if [ "${CHANGED}" -eq 1 ]; then
  echo "[INFO] Changes detected; reloading systemd and restarting kubelet"
  systemctl daemon-reload
  systemctl restart kubelet.service
else
  echo "[INFO] No changes made; kubelet restart not required"
fi

#############################################
# Step 4: Verification
#############################################
echo "[INFO] Verifying kubelet process and configuration"

# Verify kubelet process is running
if ! /bin/ps -fC kubelet >/dev/null 2>&1; then
  echo "[ERROR] kubelet process is not running after remediation"
  exit 1
fi

# Show current kubelet command line for manual review
echo "[INFO] kubelet process command line:"
/bin/ps -fC kubelet || true

# Verify config file setting
if grep -Eq '^\s*makeIPTablesUtilChains\s*:\s*true\s*($|#)' "${KUBELET_CONFIG}"; then
  echo "[INFO] Verified: ${KUBELET_CONFIG} has makeIPTablesUtilChains: true"
else
  echo "[ERROR] Verification failed: ${KUBELET_CONFIG} does not have makeIPTablesUtilChains: true"
  exit 1
fi

echo "[INFO] Remediation and verification for makeIPTablesUtilChains completed successfully"