Ensure Read Only Port Is Secured

ps -fC kubelet

sudo sed -i 's/^[[:space:]]*readOnlyPort:.*$/readOnlyPort: 0/' /var/lib/kubelet/config.yaml || \
sudo grep -q '^[[:space:]]*readOnlyPort:' /var/lib/kubelet/config.yaml || \
echo 'readOnlyPort: 0' | sudo tee -a /var/lib/kubelet/config.yaml

sudo sed -i 's/--read-only-port=[0-9]\+//g' /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf
sudo grep -q -- '--read-only-port=0' /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf || \
echo 'KUBELET_ARGS="$KUBELET_ARGS --read-only-port=0"' | sudo tee -a /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf

sudo systemctl daemon-reload
sudo systemctl restart kubelet.service
sudo systemctl status kubelet -l

ps -fC kubelet

#!/usr/bin/env bash
#
# Remediation: Disable Kubelet read-only port on every worker node
# Scope: Run on every worker node (over SSH, via Ansible shell, or similar)
#
# This script:
#   - Updates kubelet config file (/var/lib/kubelet/config.yaml) if present
#   - Updates systemd drop-in kubelet args if present
#   - Sets readOnlyPort/--read-only-port to 0
#   - Restarts kubelet if changes were made
#   - Verifies that kubelet is no longer listening on a read-only port
#
# Safe to re-run: idempotent updates and no-op if already compliant.

set -euo pipefail

changed=0

backup_file() {
  local f="$1"
  if [ -f "$f" ]; then
    if [ ! -f "${f}.bak" ]; then
      cp -p "$f" "${f}.bak"
    fi
  fi
}

update_kubelet_config_yaml() {
  local cfg="/var/lib/kubelet/config.yaml"
  [ -f "$cfg" ] || return 0

  backup_file "$cfg"

  # Ensure readOnlyPort is set to 0 using yq if available; fall back to sed/awk.
  if command -v yq >/dev/null 2>&1; then
    local tmp
    tmp="$(mktemp)"
    yq -Y '.readOnlyPort = 0' "$cfg" >"$tmp"
    if ! cmp -s "$cfg" "$tmp"; then
      mv "$tmp" "$cfg"
      changed=1
    else
      rm -f "$tmp"
    fi
  else
    # Minimal YAML edit: handle cases with/without existing readOnlyPort
    if grep -qE '^\s*readOnlyPort\s*:' "$cfg"; then
      # Replace existing value with 0
      if ! grep -qE '^\s*readOnlyPort\s*:\s*0\b' "$cfg"; then
        sed -i -E 's/^\s*readOnlyPort\s*:.*/readOnlyPort: 0/' "$cfg"
        changed=1
      fi
    else
      # Append at end of file
      echo "" >>"$cfg"
      echo "readOnlyPort: 0" >>"$cfg"
      changed=1
    fi
  fi
}

update_systemd_kubelet_args() {
  local dropin="/etc/systemd/system/kubelet.service.d/10-kubelet-args.conf"
  [ -f "$dropin" ] || return 0

  backup_file "$dropin"

  # Normalize: ensure KUBELET_ARGS exists
  if ! grep -q '^KUBELET_ARGS=' "$dropin"; then
    echo 'KUBELET_ARGS=""' >>"$dropin"
  fi

  # Remove any existing --read-only-port flags
  local tmp
  tmp="$(mktemp)"
  # shellcheck disable=SC2001
  sed 's/--read-only-port[= ][^ "]*//g' "$dropin" >"$tmp"

  # Ensure single space normalization (optional)
  if ! grep -q -- '--read-only-port=0' "$tmp"; then
    # Append the flag to KUBELET_ARGS line
    awk '
      /^KUBELET_ARGS=/ {
        # Remove trailing quote, append flag, re-add quote
        sub(/^KUBELET_ARGS="/, "", $0);
        sub(/"$/, "", $0);
        if (length($0) == 0) {
          print "KUBELET_ARGS=\"--read-only-port=0\"";
        } else {
          print "KUBELET_ARGS=\"" $0 " --read-only-port=0\"";
        }
        next;
      }
      { print }
    ' "$tmp" >"${tmp}.new"
    mv "${tmp}.new" "$tmp"
  fi

  if ! cmp -s "$dropin" "$tmp"; then
    mv "$tmp" "$dropin"
    changed=1
  else
    rm -f "$tmp"
  fi
}

restart_kubelet_if_needed() {
  if [ "$changed" -eq 1 ]; then
    systemctl daemon-reload
    systemctl restart kubelet.service
  fi
}

verify() {
  echo "Verification on this node:"
  echo "1) kubelet process flags:"
  /bin/ps -fC kubelet || true

  echo
  echo "2) Effective kubelet config (if API is available):"
  if command -v kubectl >/dev/null 2>&1; then
    kubectl get node "$(hostname)" -o yaml 2>/dev/null | grep -i readOnlyPort || true
  fi

  echo
  echo "3) Listening ports for kubelet read-only (ensure none except 0):"
  if command -v ss >/dev/null 2>&1; then
    ss -lntp | grep kubelet || true
  else
    netstat -lntp 2>/dev/null | grep kubelet || true
  fi
}

main() {
  update_kubelet_config_yaml
  update_systemd_kubelet_args
  restart_kubelet_if_needed
  verify
}

main "$@"