API Server Should Enable The NamespaceLifecycle Admission Plugin

sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml

# On any machine with kubectl access
kubectl get pods -n kube-system -l component=kube-apiserver -o wide

# On every control plane node
/bin/ps -ef | grep kube-apiserver | grep -v grep | grep -- '--disable-admission-plugins'

#!/usr/bin/env bash
#
# Fix: Ensure the NamespaceLifecycle admission plugin is NOT disabled
# Scope: every control plane node
# Target file: /etc/kubernetes/manifests/kube-apiserver.yaml
#
# Usage:
#   - Run on each control plane node as root.
#   - Safe to re-run; idempotent.

set -euo pipefail

APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-namespace-lifecycle"
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: Run as root on each control plane node." >&2
  exit 1
fi

if [[ ! -f "$APISERVER_MANIFEST" ]]; then
  echo "ERROR: kube-apiserver manifest not found at $APISERVER_MANIFEST" >&2
  exit 1
fi

mkdir -p "$BACKUP_DIR"
cp -p "$APISERVER_MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"

# Function: remove NamespaceLifecycle from an existing --disable-admission-plugins arg
# Handles comma-separated lists and possible surrounding spaces.
clean_disable_plugins_value() {
  local value="$1"
  local cleaned

  # Add leading/trailing commas to simplify removal
  cleaned=",$value,"

  # Remove 'NamespaceLifecycle' (with or without surrounding spaces) from list
  cleaned="$(printf '%s' "$cleaned" \
    | sed -E 's/,\s*NamespaceLifecycle\s*,/,/g')"

  # Remove possible duplicate commas
  cleaned="$(printf '%s' "$cleaned" \
    | sed -E 's/,+/,/g')"

  # Trim leading/trailing commas
  cleaned="$(printf '%s' "$cleaned" \
    | sed -E 's/^,+//; s/,+$//')"

  # Trim spaces around commas
  cleaned="$(printf '%s' "$cleaned" \
    | sed -E 's/\s*,\s*/,/g')"

  printf '%s' "$cleaned"
}

# Work on a temporary file and then move into place atomically
TMP_FILE="$(mktemp)"
cp "$APISERVER_MANIFEST" "$TMP_FILE"

# Detect if there is any --disable-admission-plugins arg present
if grep -q -- '--disable-admission-plugins' "$TMP_FILE"; then
  # Process each line containing --disable-admission-plugins
  # Supports both:
  #   - --disable-admission-plugins=Foo,Bar
  #   - --disable-admission-plugins Foo,Bar
  # We only modify NamespaceLifecycle; other plugins remain untouched.
  mapfile -t lines < <(grep -n -- '--disable-admission-plugins' "$TMP_FILE" | cut -d: -f1)

  for lineno in "${lines[@]}"; do
    line="$(sed -n "${lineno}p" "$TMP_FILE")"

    if printf '%s' "$line" | grep -qE -- '--disable-admission-plugins='; then
      # Form: --disable-admission-plugins=Foo,Bar
      before="$(printf '%s' "$line" | sed -E 's/(.*--disable-admission-plugins=)([^"]*)(.*)/\1/')"
      value="$(printf '%s' "$line" | sed -E 's/.*--disable-admission-plugins=([^"]*).*/\1/')"
      after="$(printf '%s' "$line" | sed -E 's/.*--disable-admission-plugins=[^"]*(.*)/\1/')"

      new_value="$(clean_disable_plugins_value "$value")"

      if [[ -z "$new_value" ]]; then
        # Entire list would be empty; remove the flag altogether
        # Remove ' --disable-admission-plugins=...' from the line
        newline="$(printf '%s' "$line" \
          | sed -E 's/[[:space:]]*--disable-admission-plugins=[^"[:space:]]*//')"
      else
        newline="${before}${new_value}${after}"
      fi
    else
      # Form: --disable-admission-plugins Foo,Bar
      # Split on the first occurrence of the flag
      prefix="$(printf '%s' "$line" | sed -E 's/(.*)--disable-admission-plugins(.*)/\1/')"
      rest="$(printf '%s' "$line" | sed -E 's/.*--disable-admission-plugins(.*)/\1/')"

      # Extract the value (first token after the flag)
      value="$(printf '%s' "$rest" | sed -E 's/^[[:space:]]+([^[:space:]]+).*/\1/')"
      suffix="$(printf '%s' "$rest" | sed -E 's/^[[:space:]]+[^[:space:]]+(.*)/\1/')"

      new_value="$(clean_disable_plugins_value "$value")"

      if [[ -z "$new_value" ]]; then
        # Remove the flag entirely
        newline="$(printf '%s' "$prefix$rest" \
          | sed -E 's/[[:space:]]*--disable-admission-plugins[[:space:]]+[^[:space:]]+//')"
      else
        newline="${prefix}--disable-admission-plugins ${new_value}${suffix}"
      fi
    fi

    # Replace line in temp file
    sed -i "${lineno}s~.*~${newline}~" "$TMP_FILE"
  done
else
  # No --disable-admission-plugins flag: nothing to change; the plugin is enabled by default.
  echo "INFO: --disable-admission-plugins not present; NamespaceLifecycle is not disabled."
fi

# Replace the manifest only if it changed
if cmp -s "$APISERVER_MANIFEST" "$TMP_FILE"; then
  echo "INFO: No changes required in $APISERVER_MANIFEST"
  rm -f "$TMP_FILE"
else
  mv "$TMP_FILE" "$APISERVER_MANIFEST"
  echo "INFO: Updated $APISERVER_MANIFEST (kube-apiserver static pod will restart automatically)."
fi

# Verification: ensure NamespaceLifecycle is NOT listed under --disable-admission-plugins
echo "INFO: Waiting for kube-apiserver process to be running..."
sleep 10

echo "INFO: Verifying that NamespaceLifecycle is not disabled..."
if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--disable-admission-plugins'; then
  if /bin/ps -ef | grep kube-apiserver | grep -v grep \
       | grep -- '--disable-admission-plugins' \
       | grep -q 'NamespaceLifecycle'; then
    echo "ERROR: NamespaceLifecycle is still present in --disable-admission-plugins." >&2
    exit 1
  fi
  echo "SUCCESS: kube-apiserver is running and NamespaceLifecycle is NOT disabled."
else
  echo "SUCCESS: kube-apiserver is running with no --disable-admission-plugins flag; NamespaceLifecycle is enabled by default."
fi