Ensure Kubelet Only Makes Use Strong Cryptographic Ciphers

Adjust placement/indentation if your file has a different structure; ensure it is valid YAML.

3. On every worker node, configure strong ciphers via kubelet arguments (if the kubelet is started with flags via systemd) by editing `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` and setting `--tls-cipher-suites` to the approved list (either add or replace an existing value). Open the file in an editor:  
```bash
sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

#!/usr/bin/env bash
#
# Harden kubelet TLS cipher suites on every worker node.
# Usage: run on each worker node as root (e.g. via SSH or Ansible shell).
# Safe to re-run; it will update config only when needed.

set -euo pipefail

CIPHERS="TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
KUBELET_SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"

changed_config=0
changed_systemd=0

echo "==> Hardening kubelet TLS cipher suites on host: $(hostname)"

#------------------------------
# 1) Ensure tlsCipherSuites in kubelet config file (if present)
#------------------------------
if [ -f "$KUBELET_CONFIG" ]; then
  echo "-> Detected kubelet config file: $KUBELET_CONFIG"

  # Backup once per day (simple rotation)
  ts="$(date +%Y%m%d-%H%M%S)"
  backup="$KUBELET_CONFIG.bak-$ts"
  cp "$KUBELET_CONFIG" "$backup"
  echo "   Backup created: $backup"

  # If tlsCipherSuites is already correct, do nothing
  if grep -qE '^[[:space:]]*tlsCipherSuites:' "$KUBELET_CONFIG"; then
    if grep -qE "^[[:space:]]*tlsCipherSuites:[[:space:]]*\[$CIPHERS\][[:space:]]*$" "$KUBELET_CONFIG"; then
      echo "   tlsCipherSuites already set correctly in $KUBELET_CONFIG"
    else
      echo "   Updating existing tlsCipherSuites in $KUBELET_CONFIG"
      # Normalize to a single-line array
      # This is a simple matcher that replaces any existing tlsCipherSuites line.
      # If your file uses multi-line YAML arrays, you may need to adjust manually.
      sed -i -E "s|^[[:space:]]*tlsCipherSuites:.*|tlsCipherSuites: [$CIPHERS]|" "$KUBELET_CONFIG"
      changed_config=1
    fi
  else
    echo "   Adding tlsCipherSuites to $KUBELET_CONFIG"
    {
      echo ""
      echo "tlsCipherSuites: [$CIPHERS]"
    } >> "$KUBELET_CONFIG"
    changed_config=1
  fi
else
  echo "-> No kubelet config file found at $KUBELET_CONFIG, skipping file-based config."
fi

#------------------------------
# 2) Ensure --tls-cipher-suites in systemd kubelet drop-in (if present)
#------------------------------
if [ -f "$KUBELET_SYSTEMD_DROPIN" ]; then
  echo "-> Detected kubelet systemd drop-in: $KUBELET_SYSTEMD_DROPIN"

  ts="$(date +%Y%m%d-%H%M%S)"
  backup="$KUBELET_SYSTEMD_DROPIN.bak-$ts"
  cp "$KUBELET_SYSTEMD_DROPIN" "$backup"
  echo "   Backup created: $backup"

  if grep -q -- "--tls-cipher-suites=" "$KUBELET_SYSTEMD_DROPIN"; then
    if grep -q -- "--tls-cipher-suites=$CIPHERS" "$KUBELET_SYSTEMD_DROPIN"; then
      echo "   --tls-cipher-suites already set correctly in $KUBELET_SYSTEMD_DROPIN"
    else
      echo "   Updating existing --tls-cipher-suites in $KUBELET_SYSTEMD_DROPIN"
      sed -i -E "s|--tls-cipher-suites=[^[:space:]]*|--tls-cipher-suites=$CIPHERS|g" "$KUBELET_SYSTEMD_DROPIN"
      changed_systemd=1
    fi
  else
    echo "   Adding --tls-cipher-suites to kubelet ExecStart in $KUBELET_SYSTEMD_DROPIN"
    # Append parameter inside ExecStart line
    sed -i -E "s|^(ExecStart=.*kubelet)(.*)$|\1 --tls-cipher-suites=$CIPHERS\2|" "$KUBELET_SYSTEMD_DROPIN"
    changed_systemd=1
  fi
else
  echo "-> No kubelet systemd drop-in at $KUBELET_SYSTEMD_DROPIN, skipping flag-based config."
fi

#------------------------------
# 3) Restart kubelet if anything changed
#------------------------------
if [ "$changed_config" -eq 1 ] || [ "$changed_systemd" -eq 1 ]; then
  echo "-> Changes detected; reloading systemd and restarting kubelet"
  systemctl daemon-reload
  systemctl restart kubelet.service
  echo "   kubelet restarted (this may temporarily disrupt workloads on this node)"
else
  echo "-> No changes made; kubelet restart not required."
fi

#------------------------------
# 4) Verification (adapted from audit)
#------------------------------
echo "==> Verification: kubelet process and effective TLS cipher suites"

echo "-- kubelet process:"
/bin/ps -fC kubelet || echo "kubelet process not found"

echo "-- Checking for tlsCipherSuites in $KUBELET_CONFIG (if file exists):"
if [ -f "$KUBELET_CONFIG" ]; then
  grep -E '^[[:space:]]*tlsCipherSuites:' "$KUBELET_CONFIG" || echo "tlsCipherSuites not set in $KUBELET_CONFIG"
else
  echo "$KUBELET_CONFIG not present"
fi

echo "-- Checking for --tls-cipher-suites flag in kubelet process:"
/bin/ps -C kubelet -o args= | grep -- "--tls-cipher-suites=" || echo "--tls-cipher-suites flag not present on kubelet process"

echo "==> Completed on host: $(hostname)"