Kube-Proxy Metrics Service Bound To Localhost

#!/usr/bin/env bash
#
# Remediate CISKubernetes 4.3.1:
# Ensure that the kube-proxy metrics service is bound to localhost (127.0.0.1:10249)
#
# Run this script on every worker node as root.
# It is safe to re-run (idempotent).
#
# Assumptions:
# - kube-proxy is started with: kube-proxy --config=/etc/kubernetes/proxy.conf
# - /etc/kubernetes/proxy.conf is a kube-proxy config file (YAML or JSON)
#
# Operational impact:
# - This script only edits /etc/kubernetes/proxy.conf.
# - kube-proxy must be restarted (by your node/cluster management tooling) to pick up changes.

set -euo pipefail

PROXY_CONF="/etc/kubernetes/proxy.conf"
BACKUP_SUFFIX="$(date +%Y%m%d%H%M%S)"
DESIRED_METRICS_BIND_ADDRESS="127.0.0.1:10249"

log() {
  printf '[%s] %s\n' "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" "$*" >&2
}

require_root() {
  if [[ "$(id -u)" -ne 0 ]]; then
    log "ERROR: must be run as root."
    exit 1
  fi
}

check_file_exists() {
  if [[ ! -f "$PROXY_CONF" ]]; then
    log "ERROR: $PROXY_CONF not found. This script cannot proceed on this node."
    exit 1
  fi
}

backup_file() {
  local src="$1"
  local dst="${src}.bak.${BACKUP_SUFFIX}"
  cp -p "$src" "$dst"
  log "Backup created: $dst"
}

current_setting() {
  # Extract any explicit metricsBindAddress setting (basic grep, works for YAML/JSON)
  # Returns first match or empty string.
  local val
  val="$(grep -E 'metricsBindAddress' "$PROXY_CONF" | head -n 1 || true)"
  if [[ -z "$val" ]]; then
    printf '\n'
    return 0
  fi
  # Try to strip key and whitespace, keep value portion
  val="${val#*metricsBindAddress}"
  val="${val#*:}"
  val="${val//\"/}"
  val="${val//\'/}"
  val="$(echo "$val" | xargs || true)"
  printf '%s\n' "$val"
}

ensure_metrics_bind_address() {
  local current
  current="$(current_setting)"

  if [[ -z "$current" ]]; then
    log "No explicit metricsBindAddress found; adding ${DESIRED_METRICS_BIND_ADDRESS}."
    backup_file "$PROXY_CONF"

    # Heuristic: if file looks like JSON (starts with {), add JSON field; else treat as YAML.
    if head -n1 "$PROXY_CONF" | grep -q '^{'; then
      # JSON: insert/overwrite using jq if available, otherwise append a comment for manual follow-up
      if command -v jq >/dev/null 2>&1; then
        tmp="$(mktemp)"
        jq --arg v "$DESIRED_METRICS_BIND_ADDRESS" '.metricsBindAddress = $v' "$PROXY_CONF" > "$tmp"
        mv "$tmp" "$PROXY_CONF"
        log "Updated JSON metricsBindAddress to ${DESIRED_METRICS_BIND_ADDRESS}."
      else
        log "WARNING: jq not installed; cannot safely edit JSON. Please set metricsBindAddress manually to ${DESIRED_METRICS_BIND_ADDRESS} in $PROXY_CONF."
      fi
    else
      # YAML: append at end
      cat <<EOF >>"$PROXY_CONF"

# Enforced by CIS Kubernetes 4.3.1 hardening script
metricsBindAddress: ${DESIRED_METRICS_BIND_ADDRESS}
EOF
      log "Appended YAML metricsBindAddress: ${DESIRED_METRICS_BIND_ADDRESS}."
    fi
  elif [[ "$current" == "$DESIRED_METRICS_BIND_ADDRESS" ]]; then
    log "metricsBindAddress already set to ${DESIRED_METRICS_BIND_ADDRESS}; no change needed."
  else
    log "metricsBindAddress currently set to '${current}', updating to ${DESIRED_METRICS_BIND_ADDRESS}."
    backup_file "$PROXY_CONF"

    # Replace existing line containing metricsBindAddress (YAML/JSON) with desired value
    # This is a simple in-place edit, safe for typical kube-proxy configs.
    sed -i.bak.tmp \
      -E "s/^( *\"?metricsBindAddress\"?[ :]+).*/\1${DESIRED_METRICS_BIND_ADDRESS}/" \
      "$PROXY_CONF"
    rm -f "${PROXY_CONF}.bak.tmp"
    log "Updated metricsBindAddress to ${DESIRED_METRICS_BIND_ADDRESS}."
  fi
}

verify_result() {
  log "Verification: checking /etc/kubernetes/proxy.conf for metricsBindAddress=${DESIRED_METRICS_BIND_ADDRESS}"
  local after
  after="$(current_setting)"
  if [[ "$after" == "$DESIRED_METRICS_BIND_ADDRESS" ]]; then
    log "OK: metricsBindAddress is set correctly in $PROXY_CONF."
  else
    log "WARNING: metricsBindAddress not confirmed as ${DESIRED_METRICS_BIND_ADDRESS}."
    log "Current parsed value: '${after}' (empty means not found)."
  fi

  log "Verification: checking running kube-proxy process flags (may require restart to match config)."
  if /bin/ps -fC kube-proxy >/dev/null 2>&1; then
    /bin/ps -fC kube-proxy || true
  else
    log "NOTE: kube-proxy process not detected by 'ps -fC kube-proxy'. It may not be running or may use a different process name."
  fi
  log "If kube-proxy is running with a config file, restart it to apply the updated metricsBindAddress."
}

main() {
  require_root
  check_file_exists
  ensure_metrics_bind_address
  verify_result
}

main "$@"