API Server Authorization Mode Should Include RBAC

#!/usr/bin/env bash
#
# Remediation for CIS Kubernetes 1.2.8:
# Ensure kube-apiserver --authorization-mode includes RBAC on every control plane node.
#
# Usage (run on EACH CONTROL PLANE NODE as root or with sudo):
#   sudo bash fix-apiserver-authz-rbac.sh
#
# Operational impact:
#   Editing /etc/kubernetes/manifests/kube-apiserver.yaml will cause the kube-apiserver
#   static Pod to be re-created automatically by kubelet.

set -euo pipefail

APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
TMP_MANIFEST="/tmp/kube-apiserver.yaml.$$"

backup_manifest() {
  if [ -f "${APISERVER_MANIFEST}" ]; then
    local ts
    ts="$(date +%Y%m%d-%H%M%S)"
    local backup="${APISERVER_MANIFEST}.backup-${ts}"
    cp -p "${APISERVER_MANIFEST}" "${backup}"
    echo "Backup created at: ${backup}"
  else
    echo "ERROR: ${APISERVER_MANIFEST} not found on this node." >&2
    exit 1
  fi
}

ensure_rbac_in_authorization_mode() {
  # Work on a temp copy
  cp "${APISERVER_MANIFEST}" "${TMP_MANIFEST}"

  # Does an --authorization-mode flag exist?
  if grep -qE '^\s*-\s*--authorization-mode=' "${TMP_MANIFEST}"; then
    # Extract current value
    local current
    current="$(grep -E '^\s*-\s*--authorization-mode=' "${TMP_MANIFEST}" | head -n1 | sed -E 's/.*--authorization-mode=([^"]*).*/\1/')"

    # If RBAC already present, no change required
    if echo "${current}" | grep -q '\<RBAC\>'; then
      echo "--authorization-mode already includes RBAC: ${current}"
      return
    fi

    # Append RBAC to existing modes
    local updated
    if [ -z "${current}" ]; then
      updated="RBAC"
    else
      updated="${current},RBAC"
    fi

    # Idempotent in-place replacement of first occurrence
    sed -E -i '0,/^\s*-\s*--authorization-mode=/{s|^\s*-\s*--authorization-mode=.*$|    - --authorization-mode='"${updated}"'|}' "${TMP_MANIFEST}"
    echo "Updated --authorization-mode to include RBAC: ${updated}"
  else
    # No existing flag: add one under the command list
    # Insert after the kube-apiserver command line entry
    # This assumes a typical static Pod spec with 'command:' and '- kube-apiserver'
    if grep -qE '^\s*command:\s*$' "${TMP_MANIFEST}"; then
      # Insert a new line after the kube-apiserver binary line
      awk '
        /^\s*-\s*kube-apiserver(\s*|$)/ && inserted == 0 {
          print $0
          print "    - --authorization-mode=Node,RBAC"
          inserted=1
          next
        }
        { print $0 }
      ' "${TMP_MANIFEST}" > "${TMP_MANIFEST}.new"
      mv "${TMP_MANIFEST}.new" "${TMP_MANIFEST}"
      if ! grep -qE '^\s*-\s*--authorization-mode=Node,RBAC' "${TMP_MANIFEST}"; then
        echo "ERROR: Failed to insert --authorization-mode=Node,RBAC line." >&2
        exit 1
      fi
      echo "Added --authorization-mode=Node,RBAC to kube-apiserver command."
    else
      echo "ERROR: Could not locate command section to add --authorization-mode." >&2
      echo "Please edit ${APISERVER_MANIFEST} manually to include --authorization-mode=Node,RBAC." >&2
      exit 1
    fi
  fi

  # Move updated manifest into place (triggers kube-apiserver restart)
  mv "${TMP_MANIFEST}" "${APISERVER_MANIFEST}"
  echo "Updated manifest written to ${APISERVER_MANIFEST}."
}

verify_rbac_enabled() {
  echo "Waiting for kube-apiserver to restart and run with updated flags..."
  # Give kubelet a bit of time to recreate the static pod
  sleep 15

  # Verification based on the audit command
  if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--authorization-mode'; then
    if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--authorization-mode' | grep -q 'RBAC'; then
      :
    fi
  fi

  # More explicit parsing for robustness
  local ps_out
  ps_out="$(/bin/ps -ef | grep kube-apiserver | grep -v grep || true)"
  if echo "${ps_out}" | grep -q -- '--authorization-mode'; then
    if echo "${ps_out}" | grep -q 'authorization-mode' | grep -q 'RBAC'; then
      echo "VERIFICATION PASSED: kube-apiserver is running with --authorization-mode including RBAC."
      echo "${ps_out}"
    else
      echo "VERIFICATION FAILED: kube-apiserver running but --authorization-mode does not include RBAC." >&2
      echo "${ps_out}" >&2
      exit 1
    fi
  else
    echo "VERIFICATION FAILED: kube-apiserver process not found with --authorization-mode flag yet." >&2
    echo "${ps_out}" >&2
    exit 1
  fi
}

main() {
  backup_manifest
  ensure_rbac_in_authorization_mode
  verify_rbac_enabled
}

main "$@"