Ensure Minimal Audit Policy Is Created

#!/usr/bin/env bash
#
# Automation: Ensure minimal Kubernetes API server audit policy is created
# and configured via the kube-apiserver static pod manifest.
#
# Run on: every control plane node (with root privileges)
#
# Behavior:
# - Creates a minimal audit policy file if missing (idempotent)
# - Ensures kube-apiserver manifest has:
#     --audit-policy-file=/etc/kubernetes/audit-policy.yaml
#     --audit-log-path=/var/log/kubernetes/audit.log
# - Ensures /var/log/kubernetes exists
# - kubelet will automatically restart the kube-apiserver static pod
#   after the manifest is modified (expect brief control-plane disruption)
# - Verifies that the kube-apiserver process has the correct flags

set -euo pipefail

APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
AUDIT_POLICY_FILE="/etc/kubernetes/audit-policy.yaml"
AUDIT_LOG_DIR="/var/log/kubernetes"
AUDIT_LOG_FILE="${AUDIT_LOG_DIR}/audit.log"

# Minimal, broadly compatible audit policy
read -r -d '' MINIMAL_POLICY <<"EOF" || true
apiVersion: audit.k8s.io/v1
kind: Policy
# Log only metadata for all requests; adjust as needed for your org.
rules:
  - level: Metadata
EOF

require_root() {
  if [[ "$(id -u)" -ne 0 ]]; then
    echo "ERROR: This script must be run as root on each control plane node." >&2
    exit 1
  fi
}

check_manifest_exists() {
  if [[ ! -f "${APISERVER_MANIFEST}" ]]; then
    echo "ERROR: kube-apiserver manifest not found at ${APISERVER_MANIFEST}." >&2
    echo "       This script assumes a static pod manifest; adjust for your environment." >&2
    exit 1
  fi
}

ensure_audit_policy_file() {
  if [[ -f "${AUDIT_POLICY_FILE}" ]]; then
    echo "Audit policy file already exists at ${AUDIT_POLICY_FILE}; leaving as-is."
  else
    echo "Creating minimal audit policy at ${AUDIT_POLICY_FILE}."
    umask 027
    echo "${MINIMAL_POLICY}" > "${AUDIT_POLICY_FILE}"
    chmod 640 "${AUDIT_POLICY_FILE}"
  fi
}

ensure_audit_log_dir() {
  if [[ ! -d "${AUDIT_LOG_DIR}" ]]; then
    echo "Creating audit log directory ${AUDIT_LOG_DIR}."
    mkdir -p "${AUDIT_LOG_DIR}"
    chmod 750 "${AUDIT_LOG_DIR}"
  else
    echo "Audit log directory ${AUDIT_LOG_DIR} already exists."
  fi
}

# Idempotently ensure a command-line flag in the kube-apiserver manifest
ensure_apiserver_flag() {
  local flag_name="$1"      # e.g. --audit-policy-file
  local flag_value="$2"     # e.g. /etc/kubernetes/audit-policy.yaml
  local manifest="${APISERVER_MANIFEST}"

  if grep -qE "[[:space:]]${flag_name}=" "${manifest}"; then
    # Update in place
    echo "Ensuring ${flag_name} is set to ${flag_value} in ${manifest}."
    # Use sed to replace the value only; keep surrounding formatting
    sed -i.bak -E "s#(${flag_name}=)[^[:space:]]*#\1${flag_value}#g" "${manifest}"
  else
    # Add a new flag line under the kube-apiserver container args
    echo "Adding ${flag_name}=${flag_value} to ${manifest}."
    # Insert before the first line that starts with '    - --' under args:
    # This is heuristic but safe to re-run (we use grep above to avoid duplicates).
    python3 - "$manifest" "$flag_name" "$flag_value" << 'PYEOF'
import sys, yaml

manifest_path, flag_name, flag_value = sys.argv[1:]
with open(manifest_path) as f:
    doc = yaml.safe_load(f)

updated = False
for c in doc.get('spec', {}).get('containers', []):
    if c.get('name') == 'kube-apiserver':
        args = c.setdefault('command', []) or c.setdefault('args', [])
        # If "command" is used explicitly, it's usually ["kube-apiserver", ...]
        # If "args" is used, they are direct flags. We normalize to list of strings.
        if not isinstance(args, list):
            continue
        # Safeguard: avoid duplicating the flag
        if not any(a.startswith(flag_name + "=") for a in args):
            args.append(f"{flag_name}={flag_value}")
        updated = True
        break

if not updated:
    print("ERROR: Could not locate kube-apiserver container in manifest to add flag.", file=sys.stderr)
    sys.exit(1)

with open(manifest_path, "w") as f:
    yaml.safe_dump(doc, f, default_flow_style=False)
PYEOF
  fi
}

main() {
  require_root
  check_manifest_exists

  # Ensure policy file and log directory
  ensure_audit_policy_file
  ensure_audit_log_dir

  # Ensure kube-apiserver flags
  ensure_apiserver_flag "--audit-policy-file" "${AUDIT_POLICY_FILE}"
  ensure_apiserver_flag "--audit-log-path"    "${AUDIT_LOG_FILE}"

  echo "Waiting for kube-apiserver to restart with new configuration..."
  sleep 15

  echo "Verification: checking kube-apiserver process flags."
  /bin/ps -ef | grep kube-apiserver | grep -v grep || {
    echo "ERROR: kube-apiserver process not found; investigate pod status." >&2
    exit 1
  }

  if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--audit-policy-file=${AUDIT_POLICY_FILE}"; then
    echo "Verified: kube-apiserver is running with --audit-policy-file=${AUDIT_POLICY_FILE}."
  else
    echo "ERROR: kube-apiserver is not running with the expected --audit-policy-file flag." >&2
    exit 1
  fi

  if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--audit-log-path=${AUDIT_LOG_FILE}"; then
    echo "Verified: kube-apiserver is running with --audit-log-path=${AUDIT_LOG_FILE}."
  else
    echo "ERROR: kube-apiserver is not running with the expected --audit-log-path flag." >&2
    exit 1
  fi

  echo "Automation complete on this control plane node."
}

main "$@"