Ensure Etcd Auto-TLS Argument Is Not Set To True

#!/usr/bin/env bash
#
# Remediation: Ensure Etcd --auto-tls argument is not set to true
# Scope: every etcd node (control plane nodes running /etc/kubernetes/manifests/etcd.yaml)
#
# Usage: run as root on each control plane node
#   sudo bash fix-etcd-auto-tls.sh
#
# Operational impact:
#   - Editing /etc/kubernetes/manifests/etcd.yaml will cause the kubelet
#     to restart the etcd static pod.

set -euo pipefail

ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-etcd-auto-tls-$(date +%Y%m%d%H%M%S)"

echo "==> Etcd auto-tls remediation starting"

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: This script must be run as root." >&2
  exit 1
fi

if [[ ! -f "$ETCD_MANIFEST" ]]; then
  echo "No etcd manifest found at $ETCD_MANIFEST; nothing to do on this node."
  exit 0
fi

mkdir -p "$BACKUP_DIR"
cp -p "$ETCD_MANIFEST" "$BACKUP_DIR/etcd.yaml"
echo "Backup created at $BACKUP_DIR/etcd.yaml"

TMP_MANIFEST="$(mktemp)"
cp -p "$ETCD_MANIFEST" "$TMP_MANIFEST"

# 1) Normalize any existing --auto-tls flag to false
#    - Replace occurrences of --auto-tls=true with --auto-tls=false
sed -i 's/--auto-tls[[:space:]]*=[[:space:]]*true/--auto-tls=false/g' "$TMP_MANIFEST"

# 2) Ensure we do NOT have an explicit "true" flag without '=' (e.g. "--auto-tls true")
#    Convert such forms to "--auto-tls=false"
sed -i 's/--auto-tls[[:space:]]\+true/--auto-tls=false/g' "$TMP_MANIFEST"

# 3) If there is no --auto-tls flag at all, we leave it that way (removal is acceptable)
if ! grep -q -- "--auto-tls" "$TMP_MANIFEST"; then
  echo "No --auto-tls flag present; this is already compliant."
else
  echo "Ensured any existing --auto-tls flag is set to false in manifest."
fi

# Only overwrite the live manifest if there is a change
if cmp -s "$ETCD_MANIFEST" "$TMP_MANIFEST"; then
  echo "Manifest is already in desired state; no changes applied."
  rm -f "$TMP_MANIFEST"
else
  mv "$TMP_MANIFEST" "$ETCD_MANIFEST"
  echo "Updated $ETCD_MANIFEST. Kubelet will restart the etcd static pod automatically."
fi

echo "==> Waiting for etcd process to reflect configuration change..."

# Wait loop: give kubelet time to restart etcd and then verify
MAX_WAIT_SEC=120
SLEEP_SEC=5
elapsed=0
success=0

while [[ $elapsed -lt $MAX_WAIT_SEC ]]; do
  if /bin/ps -ef | /bin/grep "[e]tcd" >/dev/null 2>&1; then
    # Check that --auto-tls is not set to true in the running process
    if ! /bin/ps -ef | /bin/grep "[e]tcd" | /bin/grep -q -- "--auto-tls=true"; then
      success=1
      break
    fi
  fi
  sleep "$SLEEP_SEC"
  elapsed=$((elapsed + SLEEP_SEC))
done

echo "==> Verification: running etcd processes and their auto-tls flags:"
/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep || true

if [[ $success -eq 1 ]]; then
  echo "COMPLIANT: No etcd process is running with --auto-tls=true."
  exit 0
else
  echo "WARNING: etcd process still appears with --auto-tls=true or has not restarted yet." >&2
  echo "Review $ETCD_MANIFEST and the etcd container logs; you may need to investigate manually." >&2
  exit 1
fi