Ensure Service Account Private Key File Argument Is Appropriate

#!/usr/bin/env bash
#
# Automation: Configure --service-account-private-key-file for kube-controller-manager
#
# Run on: every control plane node (with root privileges)
#
# This script:
#   - Ensures a service account private key exists at /etc/kubernetes/pki/sa.key
#   - Adds/updates --service-account-private-key-file in
#     /etc/kubernetes/manifests/kube-controller-manager.yaml
#   - Relies on the kubelet to restart the static pod automatically
#   - Verifies the flag is active in the running process
#
# Idempotent: safe to re-run.

set -euo pipefail

KCM_MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml"
SA_KEY="/etc/kubernetes/pki/sa.key"
SA_CERT="/etc/kubernetes/pki/sa.pub"
BACKUP_SUFFIX="$(date +%Y%m%d%H%M%S)"

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: Run this script as root." >&2
  exit 1
fi

if [[ ! -f "$KCM_MANIFEST" ]]; then
  echo "ERROR: Manifest $KCM_MANIFEST not found on this node." >&2
  exit 1
fi

echo "==> Ensuring service account private key exists at $SA_KEY"

if [[ ! -f "$SA_KEY" ]]; then
  mkdir -p "$(dirname "$SA_KEY")"
  chmod 700 "$(dirname "$SA_KEY")"

  echo "    Generating new RSA private key for service accounts..."
  openssl genrsa -out "$SA_KEY" 2048

  chmod 600 "$SA_KEY"
  chown root:root "$SA_KEY"

  echo "    Generating corresponding public key at $SA_CERT..."
  openssl rsa -in "$SA_KEY" -pubout -out "$SA_CERT"
else
  echo "    Existing key found at $SA_KEY (leaving as-is)."
fi

echo "==> Updating $KCM_MANIFEST with --service-account-private-key-file flag"

cp "$KCM_MANIFEST" "${KCM_MANIFEST}.bak.${BACKUP_SUFFIX}"

if ! grep -q -- "--service-account-private-key-file=" "$KCM_MANIFEST"; then
  echo "    Flag not present; adding to manifest."

  # Insert the flag into the args list of the kube-controller-manager container
  # This sed adds the line right after the first occurrence of 'kube-controller-manager'
  # in the args section, which is typical for kubeadm-style manifests.
  sed -i '
    /- kube-controller-manager/ {
      :loop
      n
      /args:/!b loop
      n
      s/^/      - --service-account-private-key-file='"$SA_KEY"'\n/
    }
  ' "$KCM_MANIFEST"
else
  echo "    Flag already present; normalizing its value to $SA_KEY."
  # Replace any existing value with the desired path
  sed -i "s#--service-account-private-key-file=\S*#--service-account-private-key-file=${SA_KEY}#g" "$KCM_MANIFEST"
fi

echo "==> Waiting for kube-controller-manager static pod to be restarted by kubelet..."
sleep 20

echo "==> Verification: checking running kube-controller-manager process"

if /bin/ps -ef | grep kube-controller-manager | grep -v grep | grep -q -- "--service-account-private-key-file=${SA_KEY}"; then
  echo "SUCCESS: kube-controller-manager is running with --service-account-private-key-file=${SA_KEY}"
  exit 0
else
  echo "WARNING: kube-controller-manager process does not yet show the expected flag."
  echo "Run the following manually to inspect the process:"
  echo "  /bin/ps -ef | grep kube-controller-manager | grep -v grep"
  exit 1
fi