API Server Should Enable The NodeRestriction Admission Plugin

sudo cp -a /etc/kubernetes/manifests/kube-apiserver.yaml \
/etc/kubernetes/manifests/kube-apiserver.yaml.backup.$(date +%F-%H%M%S)

sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml

    - --enable-admission-plugins=NamespaceLifecycle,ServiceAccount,NodeRestriction,ResourceQuota

    - --enable-admission-plugins=NodeRestriction

sudo crictl ps | grep kube-apiserver

/bin/ps -ef | grep kube-apiserver | grep -v grep | grep -- '--enable-admission-plugins' | grep NodeRestriction

#!/usr/bin/env bash
#
# Automation: Ensure kube-apiserver enables the NodeRestriction admission plugin
# Target: every control plane node
# Effect: Editing /etc/kubernetes/manifests/kube-apiserver.yaml will restart kube-apiserver (static pod)

set -euo pipefail

APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-$(date -u +%Y%m%dT%H%M%SZ)"

echo "[*] Checking for kube-apiserver manifest at ${APISERVER_MANIFEST}"
if [[ ! -f "${APISERVER_MANIFEST}" ]]; then
  echo "ERROR: ${APISERVER_MANIFEST} not found on this node. Is this a control plane node?"
  exit 1
fi

mkdir -p "${BACKUP_DIR}"

echo "[*] Backing up current manifest to ${BACKUP_DIR}"
cp -p "${APISERVER_MANIFEST}" "${BACKUP_DIR}/kube-apiserver.yaml"

echo "[*] Ensuring --enable-admission-plugins includes NodeRestriction"

# Case 1: --enable-admission-plugins already present
if grep -q -- '--enable-admission-plugins=' "${APISERVER_MANIFEST}"; then
  # If NodeRestriction is already in the list, no change needed
  if grep -q -- '--enable-admission-plugins=.*NodeRestriction' "${APISERVER_MANIFEST}"; then
    echo "[*] NodeRestriction already enabled in --enable-admission-plugins; no manifest change required."
  else
    echo "[*] Adding NodeRestriction to existing --enable-admission-plugins list"
    # Append NodeRestriction to the list, preserving existing plugins
    # This assumes standard YAML args list where the flag is in one line
    tmpfile="$(mktemp)"
    sed -E 's/(--enable-admission-plugins=)([^"]*)/\1\2,NodeRestriction/' \
      "${APISERVER_MANIFEST}" > "${tmpfile}"
    mv "${tmpfile}" "${APISERVER_MANIFEST}"
    echo "[*] Updated --enable-admission-plugins to include NodeRestriction"
  fi
else
  echo "[*] --enable-admission-plugins not present; adding with NodeRestriction"
  # Insert a new args line under the kube-apiserver container spec
  # This will be idempotent because we guard on flag absence above.
  tmpfile="$(mktemp)"
  awk '
    /- name: kube-apiserver/ { in_container=1 }
    in_container && /args:/ && !added {
      print $0
      print "    - --enable-admission-plugins=NodeRestriction"
      added=1
      next
    }
    { print $0 }
  ' "${APISERVER_MANIFEST}" > "${tmpfile}"

  mv "${tmpfile}" "${APISERVER_MANIFEST}"
  echo "[*] Added --enable-admission-plugins=NodeRestriction to kube-apiserver args"
fi

echo "[*] Waiting for kube-apiserver static pod to restart (this may take up to a minute)..."
sleep 30

echo "[*] Verifying that kube-apiserver process has NodeRestriction enabled"
if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--enable-admission-plugins=.*NodeRestriction'; then
  echo "[OK] kube-apiserver is running with --enable-admission-plugins including NodeRestriction"
  exit 0
fi

echo "[WARN] kube-apiserver process does not yet show NodeRestriction in --enable-admission-plugins."
echo "       Re-check with:"
echo "         /bin/ps -ef | grep kube-apiserver | grep -v grep"
exit 1

sudo bash ./enable_noderestriction.sh