Kubelet Read Only Port Argument Set To 0

#!/usr/bin/env bash
#
# Purpose:
#   Disable the kubelet read-only port by setting readOnlyPort: 0
#   in /var/lib/kubelet/config.yaml on every worker node, then
#   restart kubelet and verify.
#
# Usage:
#   Run on each worker node as root (or with sudo):
#     sudo bash ./fix-kubelet-readonly-port.sh
#
# Idempotent:
#   Safe to re-run; it preserves existing config and only enforces readOnlyPort: 0.

set -euo pipefail

CONFIG_FILE="/var/lib/kubelet/config.yaml"
BACKUP_DIR="/var/lib/kubelet/backup-$(date +%Y%m%d)"
SYSTEMD_UNIT="kubelet.service"

echo "[INFO] Checking kubelet config file at ${CONFIG_FILE}"

if [[ ! -f "${CONFIG_FILE}" ]]; then
  echo "[ERROR] ${CONFIG_FILE} not found on this node."
  echo "[ERROR] This script only manages kubelet configured via ${CONFIG_FILE}."
  exit 1
fi

mkdir -p "${BACKUP_DIR}"

# Backup once per day (idempotent enough and cheap)
BACKUP_FILE="${BACKUP_DIR}/config.yaml.$(hostname)"
if [[ ! -f "${BACKUP_FILE}" ]]; then
  echo "[INFO] Backing up ${CONFIG_FILE} to ${BACKUP_FILE}"
  cp -a "${CONFIG_FILE}" "${BACKUP_FILE}"
else
  echo "[INFO] Backup ${BACKUP_FILE} already exists; skipping backup."
fi

# Ensure readOnlyPort: 0 is present.
# Strategy:
#   - If a readOnlyPort line exists, replace its value with 0.
#   - If no such line exists, append "readOnlyPort: 0" at the end.
#   This is a simple, line-based edit and assumes no YAML anchors/templates.
echo "[INFO] Ensuring readOnlyPort is set to 0 in ${CONFIG_FILE}"

if grep -Eq '^\s*readOnlyPort\s*:' "${CONFIG_FILE}"; then
  # Normalize any existing setting to 0
  sed -i -E 's/^\s*readOnlyPort\s*:.*/readOnlyPort: 0/' "${CONFIG_FILE}"
else
  echo "readOnlyPort: 0" >> "${CONFIG_FILE}"
fi

echo "[INFO] Current readOnlyPort setting:"
grep -E '^\s*readOnlyPort\s*:' "${CONFIG_FILE}" || echo "[WARN] readOnlyPort line not found after edit"

# Reload systemd and restart kubelet
echo "[INFO] Reloading systemd daemon and restarting ${SYSTEMD_UNIT}"
systemctl daemon-reload
systemctl restart "${SYSTEMD_UNIT}"

# Verification: use the same process inspection approach as the audit,
# and also confirm the config file value.
echo "[INFO] Verifying kubelet process is running and read-only port is disabled"

if ! /bin/ps -fC kubelet >/dev/null 2>&1; then
  echo "[ERROR] kubelet process not found after restart. Check systemctl status kubelet."
  exit 1
fi

echo "[INFO] kubelet process:"
/bin/ps -fC kubelet || true

echo "[INFO] Verifying readOnlyPort in ${CONFIG_FILE} is set to 0"
if grep -Eq '^\s*readOnlyPort\s*:\s*0\s*$' "${CONFIG_FILE}"; then
  echo "[INFO] readOnlyPort correctly set to 0 in config file."
else
  echo "[ERROR] readOnlyPort is not set to 0 in ${CONFIG_FILE}. Manual review required."
  exit 1
fi

echo "[INFO] Verification complete on this worker node."