API Server Should Set TLS Certificate And Private Key

#!/usr/bin/env bash
#
# Remediation for CIS Kubernetes 4.2.9:
# Ensure kube-apiserver has --tls-cert-file and --tls-private-key-file set.
#
# Run on: every control plane node in the cluster (as root or with sudo).
#
# This script:
#   - Backs up /etc/kubernetes/manifests/kube-apiserver.yaml
#   - Ensures TLS cert/key files exist (placeholders if you don't have real ones yet)
#   - Ensures the kube-apiserver manifest has the required flags
#   - Relies on the kubelet to restart the static pod automatically
#   - Verifies via the process flags
#
# NOTE: You must replace the placeholder certificate and key contents
#       with valid TLS materials following your PKI/cluster design.
#

set -euo pipefail

APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
TLS_CERT_FILE="/etc/kubernetes/pki/apiserver.crt"
TLS_KEY_FILE="/etc/kubernetes/pki/apiserver.key"
BACKUP_SUFFIX="$(date +%Y%m%d%H%M%S)"

require_root() {
  if [ "$EUID" -ne 0 ]; then
    echo "ERROR: This script must be run as root or with sudo." >&2
    exit 1
  fi
}

check_manifest_exists() {
  if [ ! -f "$APISERVER_MANIFEST" ]; then
    echo "ERROR: $APISERVER_MANIFEST not found on this node. Is this a control plane node?" >&2
    exit 1
  fi
}

backup_manifest() {
  local backup="${APISERVER_MANIFEST}.${BACKUP_SUFFIX}.bak"
  cp -p "$APISERVER_MANIFEST" "$backup"
  echo "Backup created: $backup"
}

ensure_tls_files_exist() {
  # If you already have correct TLS files from kubeadm or your PKI,
  # this will not overwrite them.
  if [ ! -f "$TLS_CERT_FILE" ]; then
    echo "WARNING: $TLS_CERT_FILE not found. Creating placeholder file."
    mkdir -p "$(dirname "$TLS_CERT_FILE")"
    cat > "$TLS_CERT_FILE" <<'EOF'
-----BEGIN CERTIFICATE-----
PLACEHOLDER-APISERVER-CERTIFICATE
Replace this placeholder with a valid apiserver TLS certificate
following your cluster's PKI design.
-----END CERTIFICATE-----
EOF
    chmod 600 "$TLS_CERT_FILE"
  fi

  if [ ! -f "$TLS_KEY_FILE" ]; then
    echo "WARNING: $TLS_KEY_FILE not found. Creating placeholder file."
    mkdir -p "$(dirname "$TLS_KEY_FILE")"
    cat > "$TLS_KEY_FILE" <<'EOF'
-----BEGIN PRIVATE KEY-----
PLACEHOLDER-APISERVER-PRIVATE-KEY
Replace this placeholder with a valid apiserver TLS private key
matching the certificate above.
-----END PRIVATE KEY-----
EOF
    chmod 600 "$TLS_KEY_FILE"
  fi
}

ensure_arg_in_manifest() {
  local arg="$1"
  local value="$2"
  local file="$3"

  # If argument is already present (with any value), do nothing
  if grep -E "^\s*- ${arg}=" "$file" >/dev/null 2>&1; then
    # Optionally normalize the value if you want strict paths;
    # here we leave existing values untouched for safety.
    return 0
  fi

  # Insert argument into the 'command:' section for kube-apiserver container
  # We look for the first '- kube-apiserver' line and add the flag immediately after.
  if grep -E "^\s*- kube-apiserver" "$file" >/dev/null 2>&1; then
    # Use awk to insert line after '- kube-apiserver'
    awk -v a="$arg" -v v="$value" '
      {
        print $0
        if ($1 == "-" && $2 == "kube-apiserver") {
          printf "    - %s=%s\n", a, v
        }
      }
    ' "$file" > "${file}.tmp"
    mv "${file}.tmp" "$file"
  else
    echo "ERROR: Could not locate '- kube-apiserver' command entry in $file; manual edit required." >&2
    exit 1
  fi
}

main() {
  require_root
  check_manifest_exists
  backup_manifest
  ensure_tls_files_exist

  echo "Ensuring --tls-cert-file and --tls-private-key-file are set in $APISERVER_MANIFEST"

  ensure_arg_in_manifest "--tls-cert-file" "$TLS_CERT_FILE" "$APISERVER_MANIFEST"
  ensure_arg_in_manifest "--tls-private-key-file" "$TLS_KEY_FILE" "$APISERVER_MANIFEST"

  echo "Manifest updated. The kubelet will automatically restart the kube-apiserver static pod."
  echo "Waiting 30 seconds for the kube-apiserver to restart..."
  sleep 30

  echo "Verification: checking kube-apiserver process flags"
  if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -- "--tls-cert-file=${TLS_CERT_FILE}" >/dev/null 2>&1 \
     && /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -- "--tls-private-key-file=${TLS_KEY_FILE}" >/dev/null 2>&1; then
    echo "SUCCESS: kube-apiserver is running with --tls-cert-file and --tls-private-key-file set."
    /bin/ps -ef | grep kube-apiserver | grep -v grep
    exit 0
  else
    echo "WARNING: kube-apiserver process does not yet show the expected TLS flags." >&2
    echo "Current kube-apiserver processes:" >&2
    /bin/ps -ef | grep kube-apiserver | grep -v grep >&2
    exit 1
  fi
}

main "$@"