Ensure That The --read-only-port Is Disabled

#!/usr/bin/env bash
#
# Disable kubelet read-only port on every worker node.
# Usage: run on each worker node as root (or with sudo).
#
# This script:
#  - Sets readOnlyPort: 0 in kubelet config if present
#  - Ensures --read-only-port=0 is set in kubelet systemd args if used
#  - Restarts kubelet if changes were made
#  - Verifies kubelet is running with read-only port disabled
#

set -euo pipefail

changed=0

backup_file() {
  local f="$1"
  if [ -f "$f" ] && [ ! -f "${f}.bak" ]; then
    cp -p "$f" "${f}.bak"
  fi
}

############################################
# 1) Handle kubelet config file (if present)
############################################

# Common kubelet config locations to check
CONFIG_CANDIDATES=(
  "/etc/kubernetes/kubelet/kubelet-config.json"
  "/var/lib/kubelet/config.yaml"
)

for cfg in "${CONFIG_CANDIDATES[@]}"; do
  if [ -f "$cfg" ]; then
    backup_file "$cfg"

    # Detect format: JSON vs YAML (simple heuristic)
    if grep -q 'readOnlyPort' "$cfg"; then
      before="$(grep -n 'readOnlyPort' "$cfg" || true)"
    else
      before=""
    fi

    # If JSON (kubelet-config.json style)
    if echo "$cfg" | grep -q '\.json$'; then
      # If key exists, set to 0; if not, add it near top-level (simple jq-less edit)
      if grep -q '"readOnlyPort"' "$cfg"; then
        sed -i 's/"readOnlyPort"[[:space:]]*:[[:space:]]*[0-9]\+/"readOnlyPort": 0/' "$cfg"
      else
        # Insert after opening brace of top-level object
        sed -i '0,/{/{s//{\
  "readOnlyPort": 0,/' "$cfg"
      fi
    else
      # Assume YAML
      # If key exists, set to 0; otherwise append to end
      if grep -q '^[[:space:]]*readOnlyPort:' "$cfg"; then
        sed -i 's/^[[:space:]]*readOnlyPort:[[:space:]]*[0-9]\+/readOnlyPort: 0/' "$cfg"
      else
        printf '\nreadOnlyPort: 0\n' >> "$cfg"
      fi
    fi

    after="$(grep -n 'readOnlyPort' "$cfg" || true)"
    if [ "$before" != "$after" ]; then
      echo "Updated readOnlyPort in $cfg:"
      echo "  before: ${before:-<none>}"
      echo "  after : ${after:-<none>}"
      changed=1
    fi
  fi
done

##################################################
# 2) Handle kubelet systemd args (if used on node)
##################################################

UNIT_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubelet-args.conf"

if [ -f "$UNIT_DROPIN" ]; then
  backup_file "$UNIT_DROPIN"

  # Ensure file has an Environment line with KUBELET_ARGS
  if ! grep -q 'KUBELET_ARGS' "$UNIT_DROPIN"; then
    # Append a basic KUBELET_ARGS definition if missing
    cat <<'EOF' >> "$UNIT_DROPIN"

[Service]
Environment="KUBELET_ARGS="
EOF
  fi

  before_line="$(grep 'KUBELET_ARGS' "$UNIT_DROPIN" || true)"

  # Normalize: if --read-only-port is present, replace its value with 0.
  if grep -q -- '--read-only-port=' "$UNIT_DROPIN"; then
    sed -i 's/--read-only-port=[0-9]\+/--read-only-port=0/g' "$UNIT_DROPIN"
  else
    # Append --read-only-port=0 inside the KUBELET_ARGS env var
    # Works for lines like: Environment="KUBELET_ARGS=...existing..."
    sed -i 's/\(Environment="[^"]*KUBELET_ARGS[^"]*=\)\([^"]*"\)/\1\2 --read-only-port=0"/' "$UNIT_DROPIN"
  fi

  after_line="$(grep 'KUBELET_ARGS' "$UNIT_DROPIN" || true)"

  if [ "$before_line" != "$after_line" ]; then
    echo "Updated KUBELET_ARGS in $UNIT_DROPIN:"
    echo "  before: ${before_line:-<none>}"
    echo "  after : ${after_line:-<none>}"
    changed=1
  fi
fi

########################################
# 3) Restart kubelet if any change made
########################################

if [ "$changed" -eq 1 ]; then
  echo "Changes detected; reloading systemd and restarting kubelet..."
  systemctl daemon-reload
  systemctl restart kubelet.service
else
  echo "No changes required; kubelet config already compliant."
fi

echo "kubelet status:"
systemctl status kubelet -l --no-pager || true

########################################
# 4) Verification: ensure flag is absent
#    or set to 0 in kubelet process args
########################################

echo
echo "Verifying kubelet does not expose read-only port > 0:"
/bin/ps -fC kubelet || true

# Fail if we see an explicit non-zero read-only port
if /bin/ps -fC kubelet 2>/dev/null | grep -q -- '--read-only-port='; then
  if /bin/ps -fC kubelet 2>/dev/null | grep -q -- '--read-only-port=0'; then
    echo "Verification: kubelet is running with --read-only-port=0 in arguments."
  else
    echo "WARNING: kubelet still has a non-zero --read-only-port in its arguments."
    exit 1
  fi
else
  echo "Verification: kubelet has no --read-only-port flag (defaults should be disabled by config)."
fi