Ensure Token Auth File Parameter Is Not Set

#!/usr/bin/env bash
#
# Automation: Remove --token-auth-file from kube-apiserver manifest
#
# Usage:
#   1) Copy this script to every control plane node (or run via SSH/Ansible).
#   2) Run as root:  sudo bash ./fix_kube_apiserver_token_auth.sh
#   3) Safe to re-run; it is idempotent.
#
# Operational impact:
#   - Editing /etc/kubernetes/manifests/kube-apiserver.yaml will cause
#     the kubelet to restart the kube-apiserver static pod on this node.

set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-token-auth-file-fix"
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

echo "=== [$(hostname)] Ensuring --token-auth-file is not set for kube-apiserver ==="

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: This script must be run as root." >&2
  exit 1
fi

if [[ ! -f "$MANIFEST" ]]; then
  echo "ERROR: Manifest not found at $MANIFEST. Nothing changed." >&2
  exit 1
fi

mkdir -p "$BACKUP_DIR"

# Backup once per timestamp; keep original name for clarity
BACKUP_FILE="$BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"
cp -p "$MANIFEST" "$BACKUP_FILE"
echo "Backup created: $BACKUP_FILE"

# Check if --token-auth-file is present
if ! grep -q -- '--token-auth-file' "$MANIFEST"; then
  echo "No --token-auth-file parameter found in $MANIFEST; no changes needed."
else
  echo "Removing --token-auth-file from $MANIFEST ..."

  # Remove argument lines or inline arguments containing --token-auth-file
  # Handles both list-form args:
  #   - --token-auth-file=/path
  # and combined lines:
  #   - --foo=bar --token-auth-file=/path --baz=qux
  #
  # Strategy:
  #   1) Delete any YAML list items that *only* contain --token-auth-file.
  #   2) For lines with multiple args, strip just the token-auth-file portion.

  # Step 1: Drop lines that are dedicated token-auth-file args
  # e.g. "    - --token-auth-file=/etc/kubernetes/tokens"
  sed -i '/--token-auth-file[= ]/d' "$MANIFEST"

  # Step 2: Clean up any residual inline occurrences (defensive)
  # Replace " --token-auth-file=VALUE" with empty string (space-prefixed)
  sed -i 's/ --token-auth-file[^ ]*//g' "$MANIFEST"
  # Also handle start-of-line case in args list
  sed -i 's/^- *--token-auth-file[^ ]* *//g' "$MANIFEST"

  echo "Updated $MANIFEST to remove --token-auth-file."
  echo "kube-apiserver static pod will be restarted automatically by kubelet."
fi

# Verification: ensure kube-apiserver is running without --token-auth-file
echo "Waiting briefly for kube-apiserver to stabilize..."
sleep 10

echo "=== Verification: checking running kube-apiserver process for --token-auth-file ==="
/bin/ps -ef | grep kube-apiserver | grep -v grep || {
  echo "WARNING: kube-apiserver process not found. It may still be starting or there is an issue." >&2
}

if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--token-auth-file'; then
  echo "FAIL: kube-apiserver is still running with --token-auth-file set." >&2
  echo "Inspect $MANIFEST and kubelet logs for issues." >&2
  exit 1
else
  echo "PASS: kube-apiserver is running without --token-auth-file."
fi