Client Certificate Authentication Should Not Be Used For Users

#!/usr/bin/env bash
# Purpose: Report use of client-certificate auth for *users* so it can be
# reviewed and migrated to OIDC or other mechanisms.
#
# Requirements:
#   - Run on any machine with kubectl access and cluster-admin privileges.
#   - kubectl must be configured to talk to the target cluster.

set -euo pipefail

echo "=== Cluster-wide authentication configuration review ==="
echo

###############################################################################
# 1) Inspect kube-apiserver authentication flags (from static pod manifest)
###############################################################################
echo "[1] kube-apiserver authentication flags"

# Try all namespaces in case control-plane is not in kube-system
for ns in kube-system kube-public default; do
  if kubectl get pod -n "$ns" 2>/dev/null | grep -q 'kube-apiserver'; then
    APISERVER_NS="$ns"
    break
  fi
done

if [ -z "${APISERVER_NS:-}" ]; then
  echo "  !! No kube-apiserver pod found via kubectl (managed control-plane or restricted access)."
  echo "     Review /etc/kubernetes/manifests/kube-apiserver.yaml directly on every control plane node."
else
  echo "  Using namespace: $APISERVER_NS"
  echo

  # Extract command-line flags from kube-apiserver container spec
  kubectl get pod -n "$APISERVER_NS" -l component=kube-apiserver -o jsonpath='{range .items[*]}Name: {.metadata.name}{"\n"}Command: {.spec.containers[0].command}{"\n\n"}{end}' 2>/dev/null \
    || kubectl get pod -n "$APISERVER_NS" -o jsonpath='{range .items[*]}Name: {.metadata.name}{"\n"}Command: {.spec.containers[0].command}{"\n\n"}{end}'

  echo
  echo ">>> Review for these flags indicating client certificate auth is enabled:"
  echo "    --client-ca-file=..."
  echo "    --requestheader-client-ca-file=..."
  echo
  echo "    Presence of these flags means the API server accepts client certificates."
  echo "    You must determine whether they are used for *human users* vs nodes/services."
fi

###############################################################################
# 2) List client-certificate usage in kubeconfigs (users & contexts)
###############################################################################
echo
echo "[2] kubeconfig objects in the cluster that reference client certificates"
echo

# Get all kubeconfig-like Secrets and ConfigMaps in kube-system and default
# (common locations), and show entries that use client-certificate-data/authority
for ns in kube-system default; do
  echo "  Namespace: $ns"
  echo "  - Secrets with potential kubeconfigs using client certificates:"
  kubectl get secrets -n "$ns" -o jsonpath='{range .items[?(@.type=="Opaque")]}{.metadata.name}{"\n"}{end}' 2>/dev/null | while read -r s; do
    [ -z "$s" ] && continue
    DATA_KEYS=$(kubectl get secret "$s" -n "$ns" -o jsonpath='{range .data}{@}{" "}{end}' 2>/dev/null | base64 -d 2>/dev/null || true)
    if echo "$DATA_KEYS" | grep -q "client-certificate-data"; then
      echo "    * $s (contains client-certificate-data)"
    fi
  done

  echo "  - ConfigMaps that may store kubeconfigs with client certificates:"
  kubectl get configmaps -n "$ns" -o name 2>/dev/null | while read -r cm; do
    CONTENT=$(kubectl get "$cm" -n "$ns" -o yaml 2>/dev/null)
    if printf '%s\n' "$CONTENT" | grep -q "client-certificate-data"; then
      echo "    * ${cm#configmap/} (contains client-certificate-data)"
    fi
  done
  echo
done

echo ">>> Any kubeconfig used by *human users* that contains client-certificate-data"
echo "    indicates client certificate authentication is in use for users and should"
echo "    be considered for migration to OIDC or another revocable mechanism."

###############################################################################
# 3) Enumerate cluster RoleBindings/ClusterRoleBindings tied to cert-based users
###############################################################################
echo
echo "[3] RoleBindings/ClusterRoleBindings granted to likely certificate-based users"
echo

echo "  ClusterRoleBindings:"
kubectl get clusterrolebindings -o json | \
  jq -r '.items[] | select(.subjects!=null) |
         .metadata.name as $rbname |
         .subjects[] |
         select(.kind=="User") |
         "\($rbname) -> User: \(.name)"' 2>/dev/null || echo "    (jq not available; skipping detailed subject parsing)"

echo
echo "  RoleBindings (all namespaces):"
kubectl get rolebindings --all-namespaces -o json | \
  jq -r '.items[] | select(.subjects!=null) |
         .metadata.namespace as $ns |
         .metadata.name as $rbname |
         .subjects[] |
         select(.kind=="User") |
         "\($ns)/\($rbname) -> User: \(.name)"' 2>/dev/null || echo "    (jq not available; skipping detailed subject parsing)"

echo
echo ">>> Users listed above are authenticated somehow (certs, OIDC, etc.)."
echo "    Cross-reference these users with your known OIDC identities."
echo "    Any user principals that are *not* OIDC identities likely rely on"
echo "    client certificates or other non-OIDC mechanisms."

###############################################################################
# 4) Check for OIDC configuration on kube-apiserver
###############################################################################
echo
echo "[4] OIDC configuration on kube-apiserver (from pod spec)"
echo

if [ -n "${APISERVER_NS:-}" ]; then
  kubectl get pod -n "$APISERVER_NS" -l component=kube-apiserver -o jsonpath='{range .items[*]}Name: {.metadata.name}{"\n"}Args: {.spec.containers[0].command}{"\n\n"}{end}' 2>/dev/null \
    || kubectl get pod -n "$APISERVER_NS" -o jsonpath='{range .items[*]}Name: {.metadata.name}{"\n"}Args: {.spec.containers[0].command}{"\n\n"}{end}'

  echo
  echo ">>> Look for these OIDC flags:"
  echo "    --oidc-issuer-url"
  echo "    --oidc-client-id"
  echo "    --oidc-username-claim"
  echo "    --oidc-groups-claim"
  echo
  echo "    Absence of OIDC flags, combined with presence of client-ca-file and"
  echo "    user kubeconfigs using client certificates, indicates a problematic"
  echo "    reliance on client certificates for user authentication."
else
  echo "  (kube-apiserver not visible via kubectl; verify OIDC flags in"
  echo "   /etc/kubernetes/manifests/kube-apiserver.yaml on every control plane node.)"
fi

echo
echo "=== Interpretation summary ==="
echo "- Problematic state for this check:"
echo "  * kube-apiserver has --client-ca-file configured AND"
echo "  * Human user kubeconfigs (outside node/kubelet/system accounts) contain"
echo "    client-certificate-data AND"
echo "  * OIDC flags are absent or not used for those users."
echo
echo "- Acceptable direction for this check:"
echo "  * Human users authenticate via OIDC (or another centrally revocable"
echo "    mechanism), with no remaining human user kubeconfigs relying on"
echo "    client certificates."