Ensure Bind Address Argument Is 127.0.0.1

#!/usr/bin/env bash
#
# Remediation: Ensure kube-controller-manager --bind-address is set to 127.0.0.1
# Scope: Run on every control plane node
# Effect: Editing /etc/kubernetes/manifests/kube-controller-manager.yaml will
#         cause the kube-controller-manager static pod to restart.

set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml"
TMP_MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml.tmp.$$.bak"
BACKUP_MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml.backup.$(date +%Y%m%d%H%M%S)"

if [ ! -f "$MANIFEST" ]; then
  echo "ERROR: $MANIFEST not found on this node. Are you on a control plane node?"
  exit 1
fi

echo "Backing up existing manifest to $BACKUP_MANIFEST"
cp -p "$MANIFEST" "$BACKUP_MANIFEST"

# Idempotent edit of --bind-address within the kube-controller-manager container args
# Handles cases:
# - flag missing  -> adds it
# - flag present with wrong value -> replaces with correct value
# - flag already correct -> leaves as-is
awk '
  $0 ~ /name: *kube-controller-manager/ { in_kcm=1 }
  in_kcm && $0 ~ /^ *- --bind-address=/ {
      sub(/--bind-address=[^[:space:]]+/, "--bind-address=127.0.0.1")
      found_flag=1
  }
  { print }
  END {
      if (in_kcm && !found_flag) {
          # Inject flag line after the first args: line inside the kube-controller-manager container
          # This requires a second pass done outside awk.
      }
  }
' "$MANIFEST" > "$TMP_MANIFEST"

# Detect if we still need to inject the flag (i.e., it was not present)
if ! grep -qE '^- +--bind-address=127\.0\.0\.1' "$TMP_MANIFEST"; then
  # Rebuild with injected flag under the kube-controller-manager container args
  awk '
    $0 ~ /name: *kube-controller-manager/ { in_kcm=1 }
    in_kcm && $0 ~ /^ *args:/ && !args_done {
        print
        print "    - --bind-address=127.0.0.1"
        args_done=1
        next
    }
    { print }
  ' "$TMP_MANIFEST" > "${TMP_MANIFEST}.withflag"
  mv "${TMP_MANIFEST}.withflag" "$TMP_MANIFEST"
fi

# Basic YAML sanity check: ensure we did not empty the file
if ! grep -q "kube-controller-manager" "$TMP_MANIFEST"; then
  echo "ERROR: patched manifest does not look valid; not overwriting original."
  rm -f "$TMP_MANIFEST"
  exit 1
fi

echo "Updating $MANIFEST (this will restart kube-controller-manager static pod)..."
mv "$TMP_MANIFEST" "$MANIFEST"

echo "Waiting for kube-controller-manager process to restart..."
sleep 15

echo "Verifying that kube-controller-manager is bound to 127.0.0.1..."
/bin/ps -ef | grep kube-controller-manager | grep -v grep || {
  echo "ERROR: kube-controller-manager process not found after modification."
  exit 1
}

if /bin/ps -ef | grep kube-controller-manager | grep -v grep | grep -q -- "--bind-address=127.0.0.1"; then
  echo "SUCCESS: kube-controller-manager is configured with --bind-address=127.0.0.1"
  exit 0
else
  echo "ERROR: kube-controller-manager still not using --bind-address=127.0.0.1"
  echo "Current command line:"
  /bin/ps -ef | grep kube-controller-manager | grep -v grep
  exit 1
fi