API Server Should Set Etcd Client Certificate And Key

#!/usr/bin/env bash
#
# Fix CISKubernetes 1.2.4:
# Ensure --kubelet-client-certificate and --kubelet-client-key are set
# in /etc/kubernetes/manifests/kube-apiserver.yaml on every control plane node.
#
# Run on: every control plane node (as root).
#
# Assumptions:
# - kube-apiserver is a static pod defined at /etc/kubernetes/manifests/kube-apiserver.yaml
# - Client cert/key are already provisioned at:
#     /etc/kubernetes/pki/apiserver-kubelet-client.crt
#     /etc/kubernetes/pki/apiserver-kubelet-client.key
#   (adjust CERT_PATH/KEY_PATH below if different)
#
# Operational impact:
# - Editing /etc/kubernetes/manifests/kube-apiserver.yaml will cause the
#   kubelet to restart the kube-apiserver static pod automatically.

set -euo pipefail

CERT_PATH="/etc/kubernetes/pki/apiserver-kubelet-client.crt"
KEY_PATH="/etc/kubernetes/pki/apiserver-kubelet-client.key"
MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-cis-1.2.4"
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

echo ">>> [INFO] Verifying required files and paths"

if [[ ! -f "$MANIFEST" ]]; then
  echo ">>> [ERROR] kube-apiserver manifest not found at $MANIFEST"
  echo "    This script expects a static pod manifest at that path."
  exit 1
fi

if [[ ! -f "$CERT_PATH" ]]; then
  echo ">>> [ERROR] kubelet client certificate not found at $CERT_PATH"
  echo "    Provision a valid client certificate, then re-run this script."
  exit 1
fi

if [[ ! -f "$KEY_PATH" ]]; then
  echo ">>> [ERROR] kubelet client key not found at $KEY_PATH"
  echo "    Provision a valid client key, then re-run this script."
  exit 1
fi

echo ">>> [INFO] Creating backup directory $BACKUP_DIR (if needed)"
mkdir -p "$BACKUP_DIR"

BACKUP_FILE="${BACKUP_DIR}/kube-apiserver.yaml.${TIMESTAMP}"
cp "$MANIFEST" "$BACKUP_FILE"
echo ">>> [INFO] Backup created at $BACKUP_FILE"

echo ">>> [INFO] Ensuring --kubelet-client-certificate and --kubelet-client-key are set"

# Idempotently ensure arguments are present and correct in the manifest.
# We will:
# 1. Remove any existing occurrences of these flags.
# 2. Re-add them with the desired values under the kube-apiserver container args.

TMP_MANIFEST="$(mktemp)"

# Step 1: remove existing flags (if present)
# We match lines that contain the flags and trim them; this is safe to re-run.
sed -E \
  -e 's@--kubelet-client-certificate=[^[:space:]]*@@g' \
  -e 's@--kubelet-client-key=[^[:space:]]*@@g' \
  "$MANIFEST" > "$TMP_MANIFEST"

# Step 2: normalize spacing so we don't leave empty args
# Remove any occurrences of double spaces that may have been introduced
sed -E -i 's/[[:space:]]+/ /g' "$TMP_MANIFEST"

# Step 3: ensure flags are present under the kube-apiserver container args
# We will append them as separate args lines right after the "- kube-apiserver" command.
# This is a simple, robust text insertion that is safe to re-run because
# we removed any existing flags above.

if ! grep -q -- "--kubelet-client-certificate=${CERT_PATH}" "$TMP_MANIFEST"; then
  # insert after the first occurrence of "- kube-apiserver"
  awk -v cert="--kubelet-client-certificate=${CERT_PATH}" \
      -v key="--kubelet-client-key=${KEY_PATH}" '
    /- kube-apiserver/ && inserted == 0 {
      print $0
      indent = gensub(/(^[[:space:]]*).*/, "\\1", "g", $0)
      print indent "  " cert
      print indent "  " key
      inserted = 1
      next
    }
    { print $0 }
  ' "$TMP_MANIFEST" > "${TMP_MANIFEST}.new"
  mv "${TMP_MANIFEST}.new" "$TMP_MANIFEST"
fi

# Move updated manifest into place atomically
mv "$TMP_MANIFEST" "$MANIFEST"

echo ">>> [INFO] Updated $MANIFEST"
echo ">>> [INFO] kubelet will restart the kube-apiserver static pod automatically."

# Optional: give kubelet some time to detect and restart
sleep 10

echo ">>> [INFO] Verification: checking kube-apiserver process flags"
/bin/ps -ef | grep kube-apiserver | grep -v grep || {
  echo ">>> [WARN] kube-apiserver process not currently visible; it may still be restarting."
}

echo ">>> [INFO] Ensuring flags are present in running process (once it is up)"
if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--kubelet-client-certificate=${CERT_PATH}"; then
  echo ">>> [OK] --kubelet-client-certificate is set to ${CERT_PATH} in kube-apiserver process"
else
  echo ">>> [FAIL] --kubelet-client-certificate is NOT visible in kube-apiserver process"
fi

if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--kubelet-client-key=${KEY_PATH}"; then
  echo ">>> [OK] --kubelet-client-key is set to ${KEY_PATH} in kube-apiserver process"
else
  echo ">>> [FAIL] --kubelet-client-key is NOT visible in kube-apiserver process"
fi

echo ">>> [INFO] Final manifest snippet for kubelet client flags:"
grep -n -- "kubelet-client-" "$MANIFEST" || echo ">>> [WARN] Flags not found in manifest (check file formatting)."