Ensure Make Iptables Util Chains Argument Is Set True

#!/usr/bin/env bash
#
# Fix CIS GKE 3.2.7: Ensure Kubelet --make-iptables-util-chains is true
#
# Run this on every worker node as root.
# Idempotent: safe to re-run.

set -euo pipefail

KUBELET_CONF_FILE="/var/lib/kubelet/config.yaml"
SYSTEMD_DROPIN_DIR="/etc/systemd/system/kubelet.service.d"
SYSTEMD_DROPIN_FILE="${SYSTEMD_DROPIN_DIR}/10-kubelet-args.conf"

echo "[INFO] Starting remediation for kubelet makeIPTablesUtilChains on node: $(hostname)"

# 1. Ensure systemd drop-in does NOT override make-iptables-util-chains
if [[ -f "${SYSTEMD_DROPIN_FILE}" ]]; then
  echo "[INFO] Adjusting ${SYSTEMD_DROPIN_FILE} to remove any --make-iptables-util-chains overrides"
  cp "${SYSTEMD_DROPIN_FILE}" "${SYSTEMD_DROPIN_FILE}.bak.$(date +%s)"

  # Remove any existing occurrences of --make-iptables-util-chains from KUBELET_ARGS or ExecStart
  tmpfile="$(mktemp)"
  sed -E 's/--make-iptables-util-chains(=|:)?(true|false)?[[:space:]]*//g' \
    "${SYSTEMD_DROPIN_FILE}" > "${tmpfile}"
  mv "${tmpfile}" "${SYSTEMD_DROPIN_FILE}"
fi

# 2. Ensure kubelet config file has makeIPTablesUtilChains: true
if [[ ! -f "${KUBELET_CONF_FILE}" ]]; then
  echo "[WARN] ${KUBELET_CONF_FILE} not found; creating minimal config with makeIPTablesUtilChains: true"
  mkdir -p "$(dirname "${KUBELET_CONF_FILE}")"
  cat > "${KUBELET_CONF_FILE}" <<'EOF'
kind: KubeletConfiguration
apiVersion: kubelet.config.k8s.io/v1beta1
makeIPTablesUtilChains: true
EOF
else
  echo "[INFO] Ensuring makeIPTablesUtilChains: true is set in ${KUBELET_CONF_FILE}"
  cp "${KUBELET_CONF_FILE}" "${KUBELET_CONF_FILE}.bak.$(date +%s)"

  if grep -qE '^[[:space:]]*makeIPTablesUtilChains:' "${KUBELET_CONF_FILE}"; then
    # Replace existing value with true
    sed -i -E 's/^[[:space:]]*makeIPTablesUtilChains:.*/makeIPTablesUtilChains: true/' \
      "${KUBELET_CONF_FILE}"
  else
    # Append setting near the end to avoid breaking YAML structure
    printf '\nmakeIPTablesUtilChains: true\n' >> "${KUBELET_CONF_FILE}"
  fi
fi

# 3. Reload systemd and restart kubelet
echo "[INFO] Restarting kubelet to apply configuration"
systemctl daemon-reload
systemctl restart kubelet.service

# 4. Verify kubelet is running
echo "[INFO] Verifying kubelet service status"
systemctl status kubelet -l --no-pager || {
  echo "[ERROR] kubelet service is not healthy after restart"
  exit 1
}

# 5. Verification aligned with audit: inspect kubelet process and active config
echo "[INFO] Current kubelet process:"
/bin/ps -fC kubelet || {
  echo "[ERROR] kubelet process not found"
  exit 1
}

echo "[INFO] Verifying makeIPTablesUtilChains is set to true in ${KUBELET_CONF_FILE}"
if grep -qE '^[[:space:]]*makeIPTablesUtilChains:[[:space:]]*true[[:space:]]*$' "${KUBELET_CONF_FILE}"; then
  echo "[SUCCESS] makeIPTablesUtilChains is correctly set to true in ${KUBELET_CONF_FILE}"
else
  echo "[ERROR] makeIPTablesUtilChains is not correctly set in ${KUBELET_CONF_FILE}"
  exit 1
fi

echo "[INFO] Remediation for this node completed successfully."