Ensure Audit Log Maxage Argument Is Appropriate

#!/usr/bin/env bash
#
# Fix: Ensure kube-apiserver --audit-log-maxage is set to 30
# Scope: Run on every control plane node (as root)
# Effect: Editing /etc/kubernetes/manifests/kube-apiserver.yaml will restart kube-apiserver (static pod)

set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-$(date +%Y%m%d%H%M%S)"

echo "==> Ensuring kube-apiserver --audit-log-maxage is set to 30"
echo "    Manifest: ${MANIFEST}"

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: This script must be run as root." >&2
  exit 1
fi

if [[ ! -f "${MANIFEST}" ]]; then
  echo "ERROR: ${MANIFEST} not found on this node; is this a control plane node?" >&2
  exit 1
fi

# Backup manifest once per run
mkdir -p "${BACKUP_DIR}"
cp -p "${MANIFEST}" "${BACKUP_DIR}/"
echo "Backup created at ${BACKUP_DIR}/kube-apiserver.yaml"

# Idempotent edit:
# 1) If --audit-log-maxage exists, set its value to 30
# 2) If it does not exist, add it as a new - --audit-log-maxage=30 line under containers[].command
#
# Assumptions: typical kubeadm-style static pod manifest (command list with one arg per line).

# Step 1: Normalize any existing --audit-log-maxage to 30
if grep -q -- '--audit-log-maxage=' "${MANIFEST}"; then
  echo "Found existing --audit-log-maxage, updating value to 30"
  # Replace any existing value with 30
  sed -i 's/--audit-log-maxage=[0-9][0-9]*/--audit-log-maxage=30/g' "${MANIFEST}"
fi

# Step 2: If argument not present at all, add it
if ! grep -q -- '--audit-log-maxage=' "${MANIFEST}"; then
  echo "No --audit-log-maxage found, inserting --audit-log-maxage=30"

  # Insert below the first existing command argument line under 'command:' for kube-apiserver container
  # This is a YAML-sensitive insertion but robust for common kubeadm layouts.
  # We match the line '- kube-apiserver' and insert the new arg right after it.
  if grep -qE '^[[:space:]]*- kube-apiserver$' "${MANIFEST}"; then
    # Determine indentation from the '- kube-apiserver' line
    INDENT=$(grep -E '^[[:space:]]*- kube-apiserver$' "${MANIFEST}" | head -n1 | sed 's/\S.*//')
    # Insert the new line after '- kube-apiserver'
    # Use awk to remain idempotent and avoid duplicate insertion
    awk -v indent="${INDENT}" '
      BEGIN { inserted=0 }
      {
        print $0
        if ($0 ~ "^[[:space:]]*- kube-apiserver$" && inserted==0) {
          print indent "  - --audit-log-maxage=30"
          inserted=1
        }
      }
    ' "${MANIFEST}" > "${MANIFEST}.tmp"
    mv "${MANIFEST}.tmp" "${MANIFEST}"
  else
    echo "WARNING: Could not locate '- kube-apiserver' command line to insert argument."
    echo "Please review ${MANIFEST} manually to ensure --audit-log-maxage=30 is set."
  fi
fi

echo "Change applied (or already in desired state)."
echo "kube-apiserver static pod will be restarted automatically by kubelet if the manifest changed."

# Verification: confirm running kube-apiserver process has --audit-log-maxage=30
echo "==> Verifying running kube-apiserver arguments"

# Wait briefly for static pod restart if needed
sleep 10

if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--audit-log-maxage=30'; then
  echo "VERIFIED: kube-apiserver is running with --audit-log-maxage=30"
  exit 0
else
  echo "WARNING: kube-apiserver process does not show --audit-log-maxage=30 yet."
  echo "Current kube-apiserver processes:"
  /bin/ps -ef | grep kube-apiserver | grep -v grep || true
  echo "Check ${MANIFEST} and kubelet status on this control plane node."
  exit 1
fi