Ensure Hostname Override Argument Is Disabled

#!/usr/bin/env bash
#
# Automates CIS Kubernetes 4.2.8 remediation:
# Ensure kubelet is not started with --hostname-override on worker nodes.
#
# Usage:
#   1) Put all worker node hostnames or IPs into /root/worker-nodes.txt, one per line.
#   2) Ensure passwordless SSH and sudo (NOPASSWD) for the remote user.
#   3) Run this script from an admin machine:
#         chmod +x fix-kubelet-hostname-override.sh
#         ./fix-kubelet-hostname-override.sh
#
# Re-runnable: yes (idempotent).
#

set -euo pipefail

WORKER_LIST_FILE="/root/worker-nodes.txt"
REMOTE_USER="root"

if [[ ! -f "${WORKER_LIST_FILE}" ]]; then
  echo "Worker node list not found: ${WORKER_LIST_FILE}" >&2
  exit 1
fi

echo "Starting CIS 4.2.8 remediation on worker nodes from ${WORKER_LIST_FILE}"
echo

while IFS= read -r NODE; do
  [[ -z "${NODE}" ]] && continue
  echo "=== Processing worker node: ${NODE} ==="

  ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "${REMOTE_USER}@${NODE}" bash -s << 'EOF'
set -euo pipefail

SERVICE_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
BACKUP_SUFFIX="$(date +%Y%m%d%H%M%S)"

if [[ ! -f "${SERVICE_DROPIN}" ]]; then
  echo "  [WARN] kubelet drop-in not found at ${SERVICE_DROPIN}; skipping node."
  exit 0
fi

echo "  - Backing up ${SERVICE_DROPIN} to ${SERVICE_DROPIN}.${BACKUP_SUFFIX}.bak"
cp -p "${SERVICE_DROPIN}" "${SERVICE_DROPIN}.${BACKUP_SUFFIX}.bak"

ORIG_CONTENT="$(cat "${SERVICE_DROPIN}")"

# Remove any occurrence of --hostname-override from the file, including in
# KUBELET_SYSTEM_PODS_ARGS or other argument variables. Preserve rest of line.
TMP_FILE="$(mktemp)"
echo "${ORIG_CONTENT}" | \
  sed -E 's/--hostname-override(=[^[:space:]]*)?//g' | \
  sed -E 's/[[:space:]]+/ /g' > "${TMP_FILE}"

if cmp -s "${SERVICE_DROPIN}" "${TMP_FILE}"; then
  echo "  - No --hostname-override argument found; no change needed."
  rm -f "${TMP_FILE}"
else
  echo "  - Updating ${SERVICE_DROPIN} to remove --hostname-override"
  mv "${TMP_FILE}" "${SERVICE_DROPIN}"
  chown root:root "${SERVICE_DROPIN}"
  chmod 644 "${SERVICE_DROPIN}"

  echo "  - Reloading systemd and restarting kubelet (this will restart kubelet)"
  systemctl daemon-reload
  systemctl restart kubelet.service
fi

echo "  - Verifying kubelet process flags do not contain --hostname-override"
/bin/ps -fC kubelet || { echo "    [ERROR] kubelet process not found after restart."; exit 1; }

if /bin/ps -fC kubelet | grep -q -- "--hostname-override"; then
  echo "    [ERROR] kubelet still running with --hostname-override on this node."
  exit 1
else
  echo "    [OK] kubelet is running without --hostname-override."
fi

EOF

  RC=$?
  if [[ ${RC} -ne 0 ]]; then
    echo "!!! Remediation FAILED on node ${NODE} (exit code ${RC})"
  else
    echo "--- Remediation SUCCESSFUL on node ${NODE}"
  fi
  echo

done < "${WORKER_LIST_FILE}"

echo "All nodes processed."