Ensure Profiling Argument Is Set False

#!/usr/bin/env bash
#
# Automation to enforce --profiling=false in /etc/kubernetes/manifests/kube-apiserver.yaml
# Run this on every control plane node with root privileges.
set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-profiling-fix"
TIMESTAMP="$(date +%Y%m%d%H%M%S)"

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: Run as root on each control plane node."
  exit 1
fi

if [[ ! -f "$MANIFEST" ]]; then
  echo "ERROR: kube-apiserver manifest not found at $MANIFEST"
  exit 1
fi

mkdir -p "$BACKUP_DIR"
cp -a "$MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"

# Ensure a --profiling flag is present and set to false.
# Handles three cases idempotently:
# 1) Flag already set to false       -> no change
# 2) Flag set to true or other      -> updated to false
# 3) Flag missing                   -> appended to the kube-apiserver command line
tmpfile="$(mktemp)"
trap 'rm -f "$tmpfile"' EXIT

awk '
/^- .*kube-apiserver(\s|$)/ {
  in_cmd=1
}
in_cmd && /--profiling=/ {
  sub(/--profiling=[^[:space:]]+/, "--profiling=false")
  found=1
}
{ print }
END {
  if (in_cmd && !found) {
    print "    - --profiling=false"
  }
}
' "$MANIFEST" > "$tmpfile"

# Only overwrite if there is a change
if ! diff -q "$MANIFEST" "$tmpfile" >/dev/null 2>&1; then
  mv "$tmpfile" "$MANIFEST"
  echo "Updated $MANIFEST with --profiling=false. kube-apiserver static pod will restart automatically."
else
  echo "No changes required; --profiling=false already enforced."
  rm -f "$tmpfile"
fi

# Verification: confirm kube-apiserver is running with --profiling=false
echo "Waiting up to 60s for kube-apiserver to reflect new arguments..."
for i in {1..12}; do
  if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--profiling=false'; then
    echo "SUCCESS: kube-apiserver is running with --profiling=false:"
    /bin/ps -ef | grep kube-apiserver | grep -v grep
    exit 0
  fi
  sleep 5
done

echo "WARNING: kube-apiserver process not yet showing --profiling=false. Current processes:"
/bin/ps -ef | grep kube-apiserver | grep -v grep
exit 1