Ensure Client Ca File Argument Is Set As Appropriate

#!/usr/bin/env bash
#
# Purpose: Ensure kubelet is configured with a client CA file for x509 auth
# Scope:   Run on every worker node (as root)
#
# Behavior:
# - Ensures authentication.x509.clientCAFile is set in /var/lib/kubelet/config.yaml
# - Leaves an existing non-empty clientCAFile unchanged
# - Restarts kubelet only if a change is made
# - Verifies kubelet is running with a client CA configured

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
# Adjust this path if your cluster uses a different CA location
DEFAULT_CLIENT_CA_FILE="/etc/kubernetes/pki/ca.crt"
BACKUP_SUFFIX=".pre_clientcafile.bak_$(date +%Y%m%d%H%M%S)"

require_root() {
  if [[ "$(id -u)" -ne 0 ]]; then
    echo "ERROR: This script must be run as root on each worker node." >&2
    exit 1
  fi
}

check_file_exists() {
  local f="$1"
  if [[ ! -f "$f" ]]; then
    echo "ERROR: Required file not found: $f" >&2
    exit 1
  fi
}

ensure_yq() {
  if ! command -v yq >/dev/null 2>&1; then
    echo "ERROR: This script requires 'yq' (YAML processor) to modify $KUBELET_CONFIG safely." >&2
    echo "Install v4+ of 'yq' (https://github.com/mikefarah/yq) and re-run." >&2
    exit 1
  fi
}

backup_file_if_needed() {
  local f="$1"
  if [[ -f "$f" ]]; then
    cp -p "$f" "${f}${BACKUP_SUFFIX}"
    echo "Backup created: ${f}${BACKUP_SUFFIX}"
  fi
}

configure_kubelet_client_ca() {
  local cfg="$1"
  local ca_file="$2"
  local changed=0

  # If authentication.x509.clientCAFile is already set and non-empty, do nothing
  local current
  current="$(yq '.authentication.x509.clientCAFile // ""' "$cfg")"
  if [[ -n "$current" && "$current" != "null" ]]; then
    echo "Existing clientCAFile detected in $cfg: $current"
    return 0
  fi

  echo "Setting authentication.x509.clientCAFile to $ca_file in $cfg"
  backup_file_if_needed "$cfg"
  yq -i ".authentication.x509.clientCAFile = \"$ca_file\"" "$cfg"
  changed=1

  return $changed
}

restart_kubelet_if_needed() {
  local changed="$1"
  if [[ "$changed" -eq 1 ]]; then
    echo "Reloading systemd and restarting kubelet..."
    systemctl daemon-reload
    systemctl restart kubelet.service
  else
    echo "No kubelet config change detected; not restarting kubelet."
  fi
}

verify() {
  echo "Verification: checking kubelet process and effective client CA setting..."

  echo "kubelet process:"
  /bin/ps -fC kubelet || {
    echo "ERROR: kubelet process not found after changes." >&2
    exit 1
  }

  # Show relevant flags for manual confirmation
  echo
  echo "kubelet command-line (for reference):"
  /bin/ps -o args= -C kubelet || true

  # Show effective YAML setting
  if [[ -f "$KUBELET_CONFIG" ]]; then
    echo
    echo "Configured authentication.x509.clientCAFile in $KUBELET_CONFIG:"
    yq '.authentication.x509.clientCAFile' "$KUBELET_CONFIG"
  else
    echo
    echo "WARNING: $KUBELET_CONFIG not found during verification."
  fi
}

main() {
  require_root
  check_file_exists "$KUBELET_CONFIG"
  check_file_exists "$DEFAULT_CLIENT_CA_FILE"
  ensure_yq

  local changed=0
  if configure_kubelet_client_ca "$KUBELET_CONFIG" "$DEFAULT_CLIENT_CA_FILE"; then
    # Return code 0 either way; detect change by comparing config before/after
    # Simple heuristic: if backup exists and differs, assume change
    if [[ -f "${KUBELET_CONFIG}${BACKUP_SUFFIX}" ]] && \
       ! diff -q "${KUBELET_CONFIG}${BACKUP_SUFFIX}" "$KUBELET_CONFIG" >/dev/null 2>&1; then
      changed=1
    fi
  fi

  restart_kubelet_if_needed "$changed"
  verify
}

main "$@"