Kubelet Only Makes Use Of Strong Cryptographic Ciphers

3. On every worker node, if the kubelet is configured via flags, ensure `--tls-cipher-suites` is set in the systemd drop-in (adjust this file only if your kubelet actually uses it):  
```bash
if [ -f /etc/systemd/system/kubelet.service.d/10-kubeadm.conf ]; then
  sudo sed -i '/--tls-cipher-suites=/d' /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
  sudo sed -i 's#^\(ExecStart=.*kubelet\b\)\(.*\)$#\1\2 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384#' /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
fi

#!/usr/bin/env bash
#
# Harden kubelet TLS cipher suites on every worker node.
# Usage: run as root on each worker node (or via SSH/Ansible).
#

set -euo pipefail

CIPHERS="TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"

KUBELET_CONFIG_FILE="/var/lib/kubelet/config.yaml"
KUBELET_SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"

echo "==> Hardening kubelet TLS cipher suites on node: $(hostname)"

# Ensure jq and yq are available if needed
need_cmd() {
  command -v "$1" >/dev/null 2>&1 || {
    echo "ERROR: required command '$1' not found in PATH" >&2
    exit 1
  }
}

# Prefer config file if it exists; otherwise fall back to systemd flag
if [ -f "$KUBELET_CONFIG_FILE" ]; then
  echo "==> Detected kubelet config file at $KUBELET_CONFIG_FILE"

  need_cmd yq

  # Backup once per run if not already backed up in this session
  BACKUP="${KUBELET_CONFIG_FILE}.$(date +%Y%m%d%H%M%S).bak"
  cp -p "$KUBELET_CONFIG_FILE" "$BACKUP"
  echo "    Backup created: $BACKUP"

  # Idempotently set tlsCipherSuites
  TMP_FILE="$(mktemp)"
  yq -y ".tlsCipherSuites = [\"${CIPHERS//,/\",\"}\"]" "$KUBELET_CONFIG_FILE" > "$TMP_FILE"
  chmod --reference="$KUBELET_CONFIG_FILE" "$TMP_FILE"
  mv "$TMP_FILE" "$KUBELET_CONFIG_FILE"

  echo "    Updated tlsCipherSuites in $KUBELET_CONFIG_FILE"

else
  echo "==> No kubelet config file at $KUBELET_CONFIG_FILE, using systemd flags"

  if [ ! -f "$KUBELET_SYSTEMD_DROPIN" ]; then
    echo "ERROR: $KUBELET_SYSTEMD_DROPIN not found; cannot set --tls-cipher-suites flag automatically." >&2
    echo "Create the file and define kubelet ExecStart with the desired --tls-cipher-suites." >&2
    exit 1
  fi

  # Backup
  BACKUP="${KUBELET_SYSTEMD_DROPIN}.$(date +%Y%m%d%H%M%S).bak"
  cp -p "$KUBELET_SYSTEMD_DROPIN" "$BACKUP"
  echo "    Backup created: $BACKUP"

  # Idempotently ensure --tls-cipher-suites flag is present with desired value
  TMP_FILE="$(mktemp)"
  # For simplicity and safety, replace any existing --tls-cipher-suites=... with the desired value,
  # or append it if missing, only on the ExecStart line.
  awk -v ciphers="$CIPHERS" '
    /^ExecStart=/ {
      # Remove existing --tls-cipher-suites=... occurrences
      gsub(/--tls-cipher-suites=[^ ]+/, "")
      # Ensure a single space before appending the flag
      sub(/[[:space:]]*$/,"")
      print $0 " --tls-cipher-suites=" ciphers
      next
    }
    { print }
  ' "$KUBELET_SYSTEMD_DROPIN" > "$TMP_FILE"

  chmod --reference="$KUBELET_SYSTEMD_DROPIN" "$TMP_FILE"
  mv "$TMP_FILE" "$KUBELET_SYSTEMD_DROPIN"

  echo "    Updated --tls-cipher-suites in $KUBELET_SYSTEMD_DROPIN"
fi

echo "==> Restarting kubelet (this will briefly disrupt workloads on this node)"
systemctl daemon-reload
systemctl restart kubelet.service

sleep 3

echo "==> Verification: kubelet process and configuration"

# 1) Show kubelet process (as per audit command)
echo "---- kubelet process (ps -fC kubelet) ----"
if ! /bin/ps -fC kubelet; then
  echo "ERROR: kubelet process not found after restart." >&2
  exit 1
fi

# 2) Verify effective setting depending on method
if [ -f "$KUBELET_CONFIG_FILE" ]; then
  need_cmd yq
  echo "---- tlsCipherSuites from $KUBELET_CONFIG_FILE ----"
  yq '.tlsCipherSuites' "$KUBELET_CONFIG_FILE"
else
  echo "---- ExecStart from $KUBELET_SYSTEMD_DROPIN ----"
  sed -n 's/^ExecStart=/ExecStart=/p' "$KUBELET_SYSTEMD_DROPIN"
fi

echo "==> Completed on node: $(hostname)"