Ensure Authorization Mode Argument Includes Node

#!/usr/bin/env bash
#
# Remediation: Ensure kube-apiserver --authorization-mode includes Node
# Scope: Run on every control plane node (as root)
# Effect: Editing /etc/kubernetes/manifests/kube-apiserver.yaml will restart the kube-apiserver static pod.

set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-authorization-mode-node"
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

if [ "$(id -u)" -ne 0 ]; then
  echo "ERROR: This script must be run as root on each control plane node." >&2
  exit 1
fi

if [ ! -f "$MANIFEST" ]; then
  echo "ERROR: kube-apiserver manifest not found at $MANIFEST" >&2
  exit 1
fi

mkdir -p "$BACKUP_DIR"
cp -a "$MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"

echo "Updating --authorization-mode in $MANIFEST to ensure it includes Node ..."

python3 - "$MANIFEST" << 'PYEOF'
import sys, ruamel.yaml, os

path = sys.argv[1]
yaml = ruamel.yaml.YAML()
yaml.preserve_quotes = True

with open(path, 'r') as f:
    data = yaml.load(f)

spec = data.get('spec', {})
containers = spec.get('containers', [])

for c in containers:
    if c.get('name') != 'kube-apiserver':
        continue
    args = c.get('command') or c.get('args')
    if not args:
        continue

    # Find and update --authorization-mode flag
    updated = False
    for i, a in enumerate(args):
        if a.startswith('--authorization-mode='):
            modes = a.split('=', 1)[1].split(',')
            modes = [m for m in (m.strip() for m in modes) if m]
            if 'Node' not in modes:
                modes.append('Node')
            # Keep RBAC if present; otherwise leave modes as-is except for added Node
            new_val = '--authorization-mode=' + ','.join(sorted(set(modes), key=modes.index))
            args[i] = new_val
            updated = True
            break

    # If flag missing entirely, append recommended value
    if not updated:
        args.append('--authorization-mode=Node,RBAC')

    # Write back to the correct key
    if 'command' in c:
        c['command'] = args
    else:
        c['args'] = args

with open(path, 'w') as f:
    yaml.dump(data, f)
PYEOF

echo "Manifest updated. kubelet will restart the kube-apiserver static pod automatically."

echo "Verifying kube-apiserver process has --authorization-mode including Node ..."
sleep 10

if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--authorization-mode'; then
  if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--authorization-mode=.*Node'; then
    echo "SUCCESS: kube-apiserver --authorization-mode includes Node:"
    /bin/ps -ef | grep kube-apiserver | grep -v grep | sed 's/^[[:space:]]*//'
    exit 0
  else
    echo "ERROR: kube-apiserver is running without Node in --authorization-mode." >&2
    /bin/ps -ef | grep kube-apiserver | grep -v grep | sed 's/^[[:space:]]*//'
    exit 1
  fi
else
  echo "ERROR: Could not find a running kube-apiserver process to verify." >&2
  exit 1
fi