API Server Should Set Kubelet Certificate Authority

ps -ef | grep kube-apiserver | grep -v grep
ls -l /etc/kubernetes/manifests/kube-apiserver.yaml

sudo mkdir -p /etc/kubernetes/pki
sudo cp /path/to/your/kubelet-ca.crt /etc/kubernetes/pki/kubelet-ca.crt
sudo chmod 600 /etc/kubernetes/pki/kubelet-ca.crt
sudo chown root:root /etc/kubernetes/pki/kubelet-ca.crt

sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml

    - --kubelet-certificate-authority=/etc/kubernetes/pki/kubelet-ca.crt

sudo crictl ps | grep kube-apiserver || sudo docker ps | grep kube-apiserver

sudo journalctl -u kubelet -f
# in another terminal
sudo crictl logs $(sudo crictl ps | awk '/kube-apiserver/ {print $1}') 2>&1 | grep -i kubelet

ps -ef | grep kube-apiserver | grep -v grep | grep -- '--kubelet-certificate-authority='

#!/usr/bin/env bash
#
# Automation: Ensure kube-apiserver sets --kubelet-certificate-authority
# Scope: run on every control plane node
# Prereqs:
#   - kube-apiserver is a static pod from /etc/kubernetes/manifests/kube-apiserver.yaml
#   - A valid CA file exists at /etc/kubernetes/pki/kubelet-ca.crt
#
# Idempotent: safe to re-run.

set -euo pipefail

APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
KUBELET_CA="/etc/kubernetes/pki/kubelet-ca.crt"
BACKUP_DIR="/etc/kubernetes/manifests/backup-$(date +%Y%m%d)"

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: Run this script as root on each control plane node." >&2
  exit 1
fi

if [[ ! -f "$APISERVER_MANIFEST" ]]; then
  echo "ERROR: $APISERVER_MANIFEST not found on this node; nothing to do." >&2
  exit 1
fi

if [[ ! -f "$KUBELET_CA" ]]; then
  echo "ERROR: Expected CA file $KUBELET_CA not found. Create or place the kubelet CA there, then re-run." >&2
  exit 1
fi

mkdir -p "$BACKUP_DIR"
cp -n "$APISERVER_MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.$(date +%H%M%S)"

# Detect if the flag is already set correctly
if grep -q -- "--kubelet-certificate-authority=${KUBELET_CA}" "$APISERVER_MANIFEST"; then
  echo "INFO: --kubelet-certificate-authority already set to ${KUBELET_CA} in manifest. Skipping edit."
else
  echo "INFO: Updating $APISERVER_MANIFEST with --kubelet-certificate-authority=${KUBELET_CA}"

  # Remove any existing --kubelet-certificate-authority flags (with any value)
  sed -i '/--kubelet-certificate-authority=/d' "$APISERVER_MANIFEST"

  # Insert the flag under the existing --kubelet-client-certificate arg if present,
  # otherwise append it at the end of the arguments list.
  if grep -q -- "--kubelet-client-certificate" "$APISERVER_MANIFEST"; then
    # Insert on the next line after kubelet-client-certificate
    awk -v flag="    - --kubelet-certificate-authority=${KUBELET_CA}" '
      /--kubelet-client-certificate/ && !inserted {
        print $0
        print flag
        inserted=1
        next
      }
      { print $0 }
    ' "$APISERVER_MANIFEST" > "${APISERVER_MANIFEST}.tmp"
    mv "${APISERVER_MANIFEST}.tmp" "$APISERVER_MANIFEST"
  else
    # Append near the end of the args list
    awk -v flag="    - --kubelet-certificate-authority=${KUBELET_CA}" '
      /- --/ && inargs==0 { inargs=1 }    # first arg line
      inargs && $0 ~ /^ *-/ { lastarg=NR } # track last arg line
      { lines[NR]=$0 }
      END {
        for (i=1; i<=NR; i++) {
          print lines[i]
          if (i==lastarg) print flag
        }
      }
    ' "$APISERVER_MANIFEST" > "${APISERVER_MANIFEST}.tmp"
    mv "${APISERVER_MANIFEST}.tmp" "$APISERVER_MANIFEST"
  fi

  echo "INFO: Manifest updated. kube-apiserver static pod will be restarted by kubelet."
fi

echo "INFO: Waiting for kube-apiserver process to reflect new flag..."
sleep 20

# Verification: match the audit command and confirm the flag is present
if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--kubelet-certificate-authority=${KUBELET_CA}"; then
  echo "SUCCESS: kube-apiserver is running with --kubelet-certificate-authority=${KUBELET_CA}"
  exit 0
else
  echo "ERROR: kube-apiserver process does not show --kubelet-certificate-authority=${KUBELET_CA} yet." >&2
  echo "Current kube-apiserver command line:"
  /bin/ps -ef | grep kube-apiserver | grep -v grep || true
  exit 1
fi