Ensure Client Ca File Argument Is Appropriate

#!/usr/bin/env bash
#
# Automation: Ensure kube-apiserver is started with a valid --client-ca-file
#
# Run on: every control plane node (with root privileges)
#
# Requirements:
#   - bash
#   - yq (v4) for safe YAML edits: https://github.com/mikefarah/yq
#
# Behavior:
#   - Ensures /etc/kubernetes/pki/client-ca.crt exists (or create from cluster CA if appropriate)
#   - Ensures kube-apiserver manifest has --client-ca-file set to that path
#   - Relies on kubelet to restart kube-apiserver static pod
#   - Idempotent: safe to re-run

set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
CLIENT_CA_DEFAULT="/etc/kubernetes/pki/client-ca.crt"

echo "[INFO] Starting remediation for --client-ca-file on kube-apiserver"

if [[ $EUID -ne 0 ]]; then
  echo "[ERROR] This script must be run as root on each control plane node." >&2
  exit 1
fi

if ! command -v yq >/dev/null 2>&1; then
  echo "[ERROR] yq (v4) is required but not installed. Install yq and re-run." >&2
  exit 1
fi

if [[ ! -f "$MANIFEST" ]]; then
  echo "[ERROR] kube-apiserver manifest not found at $MANIFEST" >&2
  exit 1
fi

backup_manifest() {
  local ts
  ts="$(date +%Y%m%d-%H%M%S)"
  local backup="${MANIFEST}.${ts}.bak"
  cp -p "$MANIFEST" "$backup"
  echo "[INFO] Backup created at $backup"
}

ensure_client_ca_file() {
  local ca_path="$1"

  if [[ -f "$ca_path" ]]; then
    echo "[INFO] Client CA file already exists at $ca_path"
    return 0
  fi

  # Heuristic: if no dedicated client CA exists, reuse the main cluster CA if present.
  # Adjust according to your security design before using in production.
  local cluster_ca="/etc/kubernetes/pki/ca.crt"

  if [[ -f "$cluster_ca" ]]; then
    echo "[WARN] $ca_path not found; copying $cluster_ca as client CA. Review if this matches your design."
    cp -p "$cluster_ca" "$ca_path"
    return 0
  fi

  echo "[ERROR] Neither $ca_path nor $cluster_ca exist. Create an appropriate client CA certificate and place it at $ca_path, then re-run."
  exit 1
}

set_client_ca_arg() {
  local ca_path="$1"

  # Detect if --client-ca-file already present in the manifest
  if grep -q -- "--client-ca-file=" "$MANIFEST"; then
    local current
    current="$(grep -oE -- '--client-ca-file=[^[:space:]]+' "$MANIFEST" | head -n1 | cut -d= -f2 || true)"
    if [[ "$current" == "$ca_path" ]]; then
      echo "[INFO] --client-ca-file already set correctly to $ca_path in manifest"
      return 0
    fi
    echo "[INFO] Updating existing --client-ca-file from $current to $ca_path in manifest"
    backup_manifest
    # Replace only the first occurrence
    sed -i "0,/--client-ca-file=.*$/s//--client-ca-file=${ca_path}/" "$MANIFEST"
  else
    echo "[INFO] Adding --client-ca-file=${ca_path} to kube-apiserver manifest"
    backup_manifest

    # Use yq to append the argument to the containers[0].command list
    yq -i '
      .spec.containers[0].command += ["--client-ca-file='"$ca_path"'"]
    ' "$MANIFEST"
  fi
}

verify_running_process() {
  local ca_path="$1"

  echo "[INFO] Waiting for kube-apiserver static pod restart (up to 120s)..."
  # Wait up to 120 seconds for the process to reflect the new flag
  local timeout=120
  local elapsed=0
  while (( elapsed < timeout )); do
    if ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--client-ca-file=${ca_path}"; then
      echo "[INFO] Verification succeeded: kube-apiserver running with --client-ca-file=${ca_path}"
      return 0
    fi
    sleep 5
    elapsed=$((elapsed + 5))
  done

  echo "[ERROR] Verification failed: kube-apiserver process does not show --client-ca-file=${ca_path} after ${timeout}s." >&2
  echo "[INFO] Current kube-apiserver processes:"
  ps -ef | grep kube-apiserver | grep -v grep || true
  exit 1
}

main() {
  local ca_path="$CLIENT_CA_DEFAULT"

  echo "[INFO] Ensuring client CA file exists at $ca_path"
  ensure_client_ca_file "$ca_path"

  echo "[INFO] Ensuring kube-apiserver manifest has --client-ca-file=${ca_path}"
  set_client_ca_arg "$ca_path"

  echo "[INFO] Verifying running kube-apiserver process uses --client-ca-file=${ca_path}"
  verify_running_process "$ca_path"

  echo "[INFO] Remediation complete on this control plane node."
}

main "$@"