Ensure Hostname Override Argument Is Not Set

#!/usr/bin/env bash
#
# automate_kubelet_hostname_override_removal.sh
#
# Usage:
#   Run on each worker node as root (or with sudo):
#     sudo bash automate_kubelet_hostname_override_removal.sh
#
# Idempotent:
#   - Safely edits /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
#   - Removes any --hostname-override argument from KUBELET_SYSTEM_PODS_ARGS (or any KUBELET_* vars)
#   - Reloads and restarts kubelet only if a change was made
#   - Verifies kubelet is running without --hostname-override

set -euo pipefail

SERVICE_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
BACKUP_SUFFIX=".pre_hostname_override_removal.$(date +%Y%m%d%H%M%S)"

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: This script must be run as root (use sudo)." >&2
  exit 1
fi

if [[ ! -f "$SERVICE_DROPIN" ]]; then
  echo "WARN: $SERVICE_DROPIN not found on this node; nothing to change."
  echo "Verification: kubelet process (if present) should not include --hostname-override."
  ps -fC kubelet || true
  exit 0
fi

ORIG_CONTENT="$(cat "$SERVICE_DROPIN")"

# Function to strip --hostname-override (and its value) from a line
strip_hostname_override() {
  # Works for:
  #   --hostname-override=value
  #   --hostname-override value
  # in any position within the line.
  python3 - "$1" << 'PYEOF'
import sys, shlex

line = sys.argv[1]
try:
    tokens = shlex.split(line)
except ValueError:
    print(line)
    sys.exit(0)

result = []
skip_next = False
for i, t in enumerate(tokens):
    if skip_next:
        skip_next = False
        continue
    if t.startswith("--hostname-override="):
        continue
    if t == "--hostname-override":
        if i + 1 < len(tokens):
            skip_next = True
        continue
    result.append(t)

if not result:
    print("")
else:
    # Preserve original quoting style minimally by rejoining with spaces
    print(" ".join(result))
PYEOF
}

TMP_FILE="$(mktemp)"
trap 'rm -f "$TMP_FILE"' EXIT

changed=0

while IFS= read -r line; do
  if echo "$line" | grep -q 'KUBELET_.*=.*--hostname-override'; then
    key="${line%%=*}"
    val="${line#*=}"
    stripped_val="$(strip_hostname_override "$val")"
    # Clean up potential multiple spaces
    stripped_val="$(printf '%s\n' "$stripped_val" | sed -E 's/[[:space:]]+/ /g')"
    new_line="${key}=${stripped_val}"
    echo "$new_line" >> "$TMP_FILE"
    if [[ "$new_line" != "$line" ]]; then
      changed=1
    fi
  else
    echo "$line" >> "$TMP_FILE"
  fi
done <<< "$ORIG_CONTENT"

if [[ $changed -eq 0 ]]; then
  echo "No --hostname-override argument found in $SERVICE_DROPIN; no changes made."
else
  cp "$SERVICE_DROPIN" "${SERVICE_DROPIN}${BACKUP_SUFFIX}"
  mv "$TMP_FILE" "$SERVICE_DROPIN"
  chmod --reference="${SERVICE_DROPIN}${BACKUP_SUFFIX}" "$SERVICE_DROPIN" || true
  chown --reference="${SERVICE_DROPIN}${BACKUP_SUFFIX}" "$SERVICE_DROPIN" || true

  echo "Removed --hostname-override from $SERVICE_DROPIN"
  echo "Reloading systemd and restarting kubelet (this will restart the kubelet on this node)..."
  systemctl daemon-reload
  systemctl restart kubelet.service
fi

# Verification: ensure kubelet is running and has no --hostname-override flag
echo "Verification: kubelet process and flags on this node:"
if ! ps -fC kubelet >/dev/null 2>&1; then
  echo "ERROR: kubelet process not found after changes." >&2
  ps -fC kubelet || true
  exit 1
fi

ps -fC kubelet
if ps -fC kubelet | grep -q -- "--hostname-override"; then
  echo "ERROR: kubelet is still running with --hostname-override; manual review required." >&2
  exit 1
fi

echo "Success: kubelet is running without --hostname-override on this worker node."