Ensure Kubelet Https Argument Is Enabled

#!/usr/bin/env bash
#
# Automation: Ensure kube-apiserver does not use deprecated --kubelet-https flag
#
# Scope: run on every control plane node (with root or sudo privileges)
# Effect: editing /etc/kubernetes/manifests/kube-apiserver.yaml causes the
#         kube-apiserver static pod to be recreated automatically by kubelet.

set -euo pipefail

API_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-$(date +%Y%m%d)"
CHANGED=0

if [ ! -f "$API_MANIFEST" ]; then
  echo "ERROR: $API_MANIFEST not found on this node; is this a control plane node?"
  exit 1
fi

mkdir -p "$BACKUP_DIR"

backup_file="${BACKUP_DIR}/kube-apiserver.yaml.$(date +%H%M%S)"
cp -p "$API_MANIFEST" "$backup_file"
echo "Backup of $API_MANIFEST created at $backup_file"

# Remove any occurrence of the --kubelet-https argument line
if grep -q -- '--kubelet-https' "$API_MANIFEST"; then
  # This sed deletes any line containing --kubelet-https (with or without value)
  # while preserving all other content.
  sed '/--kubelet-https/d' "$API_MANIFEST" > "${API_MANIFEST}.tmp"
  mv "${API_MANIFEST}.tmp" "$API_MANIFEST"
  CHANGED=1
  echo "Removed --kubelet-https from $API_MANIFEST"
else
  echo "--kubelet-https argument not present in $API_MANIFEST; no changes made."
fi

# If we changed the manifest, kubelet will automatically restart the apiserver pod.
if [ "$CHANGED" -eq 1 ]; then
  echo "Waiting up to 120 seconds for kube-apiserver pod to be recreated..."
  # Optional wait loop (does not fail script if unavailable)
  end=$((SECONDS+120))
  while [ $SECONDS -lt $end ]; do
    if /bin/ps -ef | grep '[k]ube-apiserver' >/dev/null 2>&1; then
      break
    fi
    sleep 5
  done
fi

echo "Verification: ensuring kube-apiserver is not started with --kubelet-https"

if /bin/ps -ef | grep '[k]ube-apiserver' | grep -- '--kubelet-https' >/dev/null 2>&1; then
  echo "FAIL: kube-apiserver still running with --kubelet-https argument:"
  /bin/ps -ef | grep kube-apiserver | grep -v grep
  exit 2
fi

echo "PASS: kube-apiserver is running without --kubelet-https argument."
/bin/ps -ef | grep kube-apiserver | grep -v grep || true