Ensure Unique Certificate Authority Is Used For Etcd

#!/usr/bin/env bash
#
# Remediation: Ensure a unique Certificate Authority is used for etcd
# Scope: Run on every etcd (control-plane) node with root privileges.
#
# This script:
#   - Verifies /etc/kubernetes/manifests/etcd.yaml exists
#   - Backs it up once
#   - Ensures --trusted-ca-file is present and points to a dedicated etcd CA
#   - Triggers kubelet to restart the etcd static pod via manifest edit
#   - Verifies etcd is running with the configured --trusted-ca-file
#
# IMPORTANT:
#   - You must create and manage the dedicated etcd CA yourself,
#     as required by your security policy and etcd documentation.
#   - This script ONLY wires that CA into the etcd static pod manifest.
#

set -euo pipefail

ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"
# Path to the dedicated etcd CA certificate; adjust if your CA is elsewhere.
ETCD_CA_FILE="/etc/kubernetes/pki/etcd/ca.crt"
BACKUP_SUFFIX=".pre-unique-etcd-ca.bak"

echo "[*] Ensuring unique Certificate Authority is configured for etcd"

if [[ $EUID -ne 0 ]]; then
  echo "[ERROR] This script must be run as root on each etcd node." >&2
  exit 1
fi

if [[ ! -f "$ETCD_MANIFEST" ]]; then
  echo "[ERROR] etcd manifest not found at ${ETCD_MANIFEST}. This node may not run etcd as a static pod." >&2
  exit 1
fi

if [[ ! -f "$ETCD_CA_FILE" ]]; then
  cat >&2 <<EOF
[ERROR] Expected etcd CA file not found at ${ETCD_CA_FILE}.

Create and place a dedicated etcd CA certificate at this path
(or adjust ETCD_CA_FILE in this script to match your environment),
following the etcd documentation and your PKI procedures.

This script does not generate or manage the CA; it only configures etcd to use it.
EOF
  exit 1
fi

# One-time backup
if [[ ! -f "${ETCD_MANIFEST}${BACKUP_SUFFIX}" ]]; then
  echo "[*] Backing up ${ETCD_MANIFEST} to ${ETCD_MANIFEST}${BACKUP_SUFFIX}"
  cp -p "${ETCD_MANIFEST}" "${ETCD_MANIFEST}${BACKUP_SUFFIX}"
else
  echo "[*] Backup already exists at ${ETCD_MANIFEST}${BACKUP_SUFFIX}, skipping backup"
fi

# Ensure the etcd container args include --trusted-ca-file pointing to ETCD_CA_FILE
echo "[*] Updating etcd manifest to ensure --trusted-ca-file=${ETCD_CA_FILE}"

TMP_MANIFEST="$(mktemp)"
cp "${ETCD_MANIFEST}" "${TMP_MANIFEST}"

# If --trusted-ca-file exists, update its value; otherwise, insert it into the args list.
if grep -q -- "--trusted-ca-file=" "${TMP_MANIFEST}"; then
  # Idempotently replace the value
  sed -i "s#--trusted-ca-file=[^\" ]*#--trusted-ca-file=${ETCD_CA_FILE}#g" "${TMP_MANIFEST}"
else
  # Insert a new arg line under the etcd container args section
  # Handles typical kubeadm-generated manifests.
  awk -v ca_arg="        - --trusted-ca-file=${ETCD_CA_FILE}" '
    /name: etcd/ { in_etcd=1 }
    in_etcd && /^\s*args:/ { in_args=1 }
    in_args && /^\s*-/ && !inserted {
      print $0
      print ca_arg
      inserted=1
      next
    }
    { print $0 }
  ' "${TMP_MANIFEST}" > "${TMP_MANIFEST}.new" && mv "${TMP_MANIFEST}.new" "${TMP_MANIFEST}"

  # If we failed to insert (no args: block or unusual layout), append to file and warn.
  if ! grep -q -- "--trusted-ca-file=${ETCD_CA_FILE}" "${TMP_MANIFEST}"; then
    cat >&2 <<EOF
[WARN] Could not automatically locate the etcd args section to insert --trusted-ca-file.
Appending the argument at the end of the manifest, but you should verify the layout manually.
EOF
    printf "    - --trusted-ca-file=%s\n" "${ETCD_CA_FILE}" >> "${TMP_MANIFEST}"
  fi
fi

# Move updated manifest into place (this will cause kubelet to restart the etcd static pod)
echo "[*] Applying updated manifest (this restarts the etcd static pod)"
cp "${TMP_MANIFEST}" "${ETCD_MANIFEST}"
rm -f "${TMP_MANIFEST}"

# Wait for etcd to restart and stabilize
echo "[*] Waiting for etcd process to reflect new arguments..."
sleep 10

# Verification: show etcd process and confirm --trusted-ca-file is present and correct
echo "[*] Verifying etcd is running with the configured --trusted-ca-file"

if ! ps -ef | grep -v grep | grep -q "[e]tcd"; then
  echo "[ERROR] etcd process not found after manifest update. Check kubelet and etcd logs." >&2
  exit 1
fi

ETCD_CMDLINE="$(ps -ef | grep -v grep | grep '[e]tcd' | head -n1)"

if echo "${ETCD_CMDLINE}" | grep -q -- "--trusted-ca-file=${ETCD_CA_FILE}"; then
  echo "[OK] etcd is running with --trusted-ca-file=${ETCD_CA_FILE}"
else
  echo "[ERROR] etcd process is running but --trusted-ca-file does not match ${ETCD_CA_FILE}." >&2
  echo "       Current command line:" >&2
  echo "       ${ETCD_CMDLINE}" >&2
  exit 1
fi

echo "[*] Remediation complete on this node."