API Server Token Auth File Should Not Be Set

#!/usr/bin/env bash
#
# Automation: Remove --token-auth-file from kube-apiserver static pod manifest
# Scope: Run on every control plane node
# Requirements: bash, sed, grep, systemctl (if kubelet is systemd-managed)
# Idempotent: safe to re-run

set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-token-auth-file-removal"
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

echo "=== [1/4] Validating environment on this control plane node ==="

if [ ! -f "$MANIFEST" ]; then
  echo "ERROR: Manifest not found at $MANIFEST. Is this a static pod control plane node?"
  exit 1
fi

mkdir -p "$BACKUP_DIR"

echo "=== [2/4] Backing up current manifest (once) ==="
# Create a timestamped backup every run, keep an initial 'pre-change' backup if not present
if [ ! -f "$BACKUP_DIR/kube-apiserver.yaml.prechange" ]; then
  cp -a "$MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.prechange"
  echo "Saved initial backup to $BACKUP_DIR/kube-apiserver.yaml.prechange"
fi
cp -a "$MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"
echo "Saved backup to $BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"

echo "=== [3/4] Editing manifest to remove --token-auth-file flag (idempotent) ==="

# If no token-auth-file is present, nothing to change
if ! grep -q -- '--token-auth-file' "$MANIFEST"; then
  echo "No --token-auth-file flag present; no changes needed."
else
  # Use a temporary file for safe in-place edit
  TMP="$(mktemp)"
  # Remove any arguments containing --token-auth-file (handles --token-auth-file=FILE and split forms)
  # This:
  #  - deletes whole lines containing ' --token-auth-file' if used on its own line
  #  - removes ' --token-auth-file=...' tokens within a line, normalizing whitespace
  awk '
  {
    line=$0
    # Remove occurrences like "--token-auth-file=/path" or "--token-auth-file /path"
    gsub(/--token-auth-file(=[^[:space:]]+)?/, "", line)
    # Remove any extra spaces introduced
    sub(/^[[:space:]]+/, "", line)
    gsub(/[[:space:]]+/, " ", line)
    # If the line becomes just a dash for YAML list item with nothing else, keep it as "-"
    if (line ~ /^-$/) { print line }
    else if (line ~ /^[[:space:]]*$/) { print "" }
    else { print line }
  }' "$MANIFEST" > "$TMP"

  mv "$TMP" "$MANIFEST"
  chmod 600 "$MANIFEST"
  echo "Removed --token-auth-file flag from $MANIFEST."
  echo "Kubelet will detect the manifest change and restart the kube-apiserver pod."
fi

echo "=== [4/4] Verification: kube-apiserver process flags ==="

# Wait briefly for kubelet to restart the static pod if a change occurred
sleep 10

# Show running kube-apiserver command line and verify absence of --token-auth-file
if ! /bin/ps -ef | grep kube-apiserver | grep -v grep >/dev/null 2>&1; then
  echo "WARNING: kube-apiserver process not currently visible in ps output."
  echo "The manifest no longer contains --token-auth-file, but ensure kube-apiserver is healthy."
else
  echo "--- kube-apiserver command line (filtered) ---"
  /bin/ps -ef | grep kube-apiserver | grep -v grep | sed 's/^/  /'
  echo "---------------------------------------------"
  if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--token-auth-file'; then
    echo "ERROR: kube-apiserver still running with --token-auth-file flag."
    echo "Investigate other configuration sources (e.g. non-static-pod deployments)."
    exit 2
  else
    echo "SUCCESS: kube-apiserver is running without --token-auth-file."
  fi
fi