Ensure Peer Auto Tls Argument Is Disabled

sudo cp -a /etc/kubernetes/manifests/etcd.yaml /etc/kubernetes/manifests/etcd.yaml.bak.$(date +%F-%H%M%S)

sudo vi /etc/kubernetes/manifests/etcd.yaml

    - --peer-auto-tls=false

sudo crictl ps | grep etcd

/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep

#!/usr/bin/env bash
#
# Disable etcd --peer-auto-tls on all control plane nodes by editing
# /etc/kubernetes/manifests/etcd.yaml.
#
# Usage (from any machine with SSH access to control-plane nodes):
#   CONTROL_PLANE_NODES=("cp-node-1" "cp-node-2") ./fix-etcd-peer-auto-tls.sh
#
# Requirements:
#   - SSH access as a user with sudo privileges on each control-plane node
#   - Bash, sed, grep on remote nodes

set -euo pipefail

if [ "${CONTROL_PLANE_NODES-}" = "" ]; then
  echo "ERROR: Set CONTROL_PLANE_NODES array in the environment, e.g.:"
  echo '  CONTROL_PLANE_NODES=("cp-node-1" "cp-node-2") ./fix-etcd-peer-auto-tls.sh'
  exit 1
fi

# Convert environment array to bash array in this script context
# shellcheck disable=SC2206
NODES=(${CONTROL_PLANE_NODES})

remote_fix_node() {
  local NODE="$1"

  echo "==== Processing control-plane node: ${NODE} ===="

  ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "${NODE}" /bin/bash -s << 'EOF'
set -euo pipefail

ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"

if [ ! -f "${ETCD_MANIFEST}" ]; then
  echo "WARN: ${ETCD_MANIFEST} not found on this node; skipping."
  exit 0
fi

echo "Backing up ${ETCD_MANIFEST} to ${ETCD_MANIFEST}.bak"
sudo cp -p "${ETCD_MANIFEST}" "${ETCD_MANIFEST}.bak"

TMP_ETCD_MANIFEST="$(mktemp)"
trap 'rm -f "${TMP_ETCD_MANIFEST}"' EXIT

# Normalize: ensure there is exactly one --peer-auto-tls flag and it is set to false.
# Strategy:
#   1. Remove any existing --peer-auto-tls occurrences completely.
#   2. Ensure we add --peer-auto-tls=false under the etcd container args list
#      if an args list exists; otherwise, do not fabricate structure (admin may add manually).

# Step 1: remove any existing --peer-auto-tls occurrences
sed -E 's/--peer-auto-tls(=true|=false)? ?//g' "${ETCD_MANIFEST}" > "${TMP_ETCD_MANIFEST}"

# Step 2: add --peer-auto-tls=false if we can safely detect the args block
# We look for the first occurrence of the etcd container args list and append
# a new line with - --peer-auto-tls=false if it is not already present.
if grep -qE '^\s*- --peer-auto-tls=false\s*$' "${TMP_ETCD_MANIFEST}"; then
  echo "--peer-auto-tls=false already present; no addition needed."
else
  if grep -qE '^\s*args:\s*$' "${TMP_ETCD_MANIFEST}"; then
    echo "Inserting - --peer-auto-tls=false into existing args list."
    # Insert the flag as the first arg under the first args: block
    awk '
      BEGIN { inserted=0 }
      /^ *args: *$/ && inserted==0 {
        print $0
        # determine indentation for args values
        match($0, /^([[:space:]]*)args:[[:space:]]*$/, m)
        indent=m[1]"  "
        print indent"- --peer-auto-tls=false"
        inserted=1
        next
      }
      { print $0 }
    ' "${TMP_ETCD_MANIFEST}" > "${TMP_ETCD_MANIFEST}.new"
    mv "${TMP_ETCD_MANIFEST}.new" "${TMP_ETCD_MANIFEST}"
  else
    echo "NOTE: No args: list detected; not inserting --peer-auto-tls=false automatically."
    echo "      The existing manifest will now have any --peer-auto-tls flags removed."
  fi
fi

echo "Writing updated manifest to ${ETCD_MANIFEST}"
sudo cp "${TMP_ETCD_MANIFEST}" "${ETCD_MANIFEST}"

echo "Waiting 5 seconds for the kubelet to restart the etcd static pod (if needed)..."
sleep 5

echo "Verifying that etcd is no longer started with --peer-auto-tls=true ..."
if /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep | /bin/grep -q -- '--peer-auto-tls=true'; then
  echo "ERROR: etcd still running with --peer-auto-tls=true on this node."
  exit 1
fi

if /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep | /bin/grep -q -- '--peer-auto-tls=false'; then
  echo "OK: etcd is running with --peer-auto-tls=false on this node."
else
  echo "OK: etcd is running without --peer-auto-tls=true on this node (flag absent or false)."
fi
EOF

  echo "==== Completed: ${NODE} ===="
}

for NODE in "${NODES[@]}"; do
  remote_fix_node "${NODE}"
done

echo "All specified control-plane nodes processed."