Ensure Etcd Cafile Argument Is Appropriate

#!/usr/bin/env bash
#
# Fix: Ensure kube-apiserver is configured with --etcd-cafile
# Scope: every control plane node
#
# Requirements:
#   - Run as root on each control plane node
#   - Static pod manifest at /etc/kubernetes/manifests/kube-apiserver.yaml
#   - etcd CA file present at /etc/kubernetes/pki/etcd/ca.crt (adjust ETCD_CA_FILE below if different)

set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-$(date +%Y%m%d)"
ETCD_CA_FILE="/etc/kubernetes/pki/etcd/ca.crt"

echo "[INFO] Verifying prerequisites..."

if [[ $EUID -ne 0 ]]; then
  echo "[ERROR] This script must be run as root." >&2
  exit 1
fi

if [[ ! -f "$MANIFEST" ]]; then
  echo "[ERROR] kube-apiserver manifest not found at $MANIFEST" >&2
  exit 1
fi

if [[ ! -f "$ETCD_CA_FILE" ]]; then
  echo "[ERROR] Etcd CA file not found at $ETCD_CA_FILE" >&2
  echo "[HINT] Place the correct etcd CA file on this node and update ETCD_CA_FILE in this script if needed." >&2
  exit 1
fi

mkdir -p "$BACKUP_DIR"
BACKUP_FILE="$BACKUP_DIR/kube-apiserver.yaml.$(date +%H%M%S)"
cp -p "$MANIFEST" "$BACKUP_FILE"
echo "[INFO] Backup created at $BACKUP_FILE"

echo "[INFO] Ensuring --etcd-cafile is configured in kube-apiserver manifest..."

# If argument already present, update its value in-place; otherwise, add it.
if grep -q -- "--etcd-cafile=" "$MANIFEST"; then
  # Idempotent replacement of existing value
  sed -i "s#--etcd-cafile=.*#--etcd-cafile=${ETCD_CA_FILE}#g" "$MANIFEST"
else
  # Insert argument under the 'command:' section for kube-apiserver
  # This keeps the YAML valid and is safe to re-run (guarded by grep above).
  awk -v cafile="$ETCD_CA_FILE" '
    $0 ~ /- kube-apiserver$/ && in_cmd == 0 {
      print $0
      in_cmd=1
      next
    }
    in_cmd == 1 && $0 ~ /^ *-/ {
      # First argument line after the binary; insert our flag before it once
      if (!inserted) {
        print "    - --etcd-cafile=" cafile
        inserted=1
      }
      print $0
      next
    }
    { print $0 }
    END {
      if (!inserted) {
        # If we never saw arguments, append the flag at the end of the file
        print "    - --etcd-cafile=" cafile
      }
    }
  ' "$MANIFEST" > "${MANIFEST}.tmp" && mv "${MANIFEST}.tmp" "$MANIFEST"
fi

echo "[INFO] Manifest updated. kube-apiserver static pod will be restarted automatically by kubelet."

echo "[INFO] Waiting for kube-apiserver process to reflect new flag..."
# Give kubelet time to restart the static pod
sleep 20

# Verification: confirm kube-apiserver is running with the correct --etcd-cafile argument
echo "[INFO] Verifying kube-apiserver process flags..."
if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--etcd-cafile=${ETCD_CA_FILE}"; then
  echo "[SUCCESS] kube-apiserver is running with --etcd-cafile=${ETCD_CA_FILE}"
  exit 0
else
  echo "[ERROR] kube-apiserver is NOT running with the expected --etcd-cafile flag." >&2
  echo "[INFO] Current kube-apiserver process line(s):" >&2
  /bin/ps -ef | grep kube-apiserver | grep -v grep >&2
  exit 1
fi