Kubelet Client CA File Argument Set As Appropriate

#!/usr/bin/env bash
#
# Automation: Ensure kube-apiserver is started with --client-ca-file on every control plane node
#
# Usage:
#   1. Run on each control plane node with sudo/root.
#   2. Adjust CA_PATH below if your client CA is at a different location.
#   3. Re‑run safely; script is idempotent.

set -euo pipefail

CA_PATH="/etc/kubernetes/pki/ca.crt"
APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
TMP_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml.tmp"

echo "[*] Running on control plane node: $(hostname)"

# Basic prechecks
if [[ ! -f "${APISERVER_MANIFEST}" ]]; then
  echo "ERROR: ${APISERVER_MANIFEST} not found. This script expects a static pod apiserver manifest."
  exit 1
fi

if [[ ! -f "${CA_PATH}" ]]; then
  echo "WARNING: Client CA file ${CA_PATH} not found."
  echo "Create/populate the appropriate client CA at this path before relying on certificate authentication."
  # We still proceed to set the flag to this path so it's wired consistently.
fi

echo "[*] Ensuring --client-ca-file is configured in ${APISERVER_MANIFEST}"

# Backup manifest once
BACKUP="${APISERVER_MANIFEST}.$(date +%Y%m%d%H%M%S).bak"
cp -n "${APISERVER_MANIFEST}" "${BACKUP}" || true

# Idempotently ensure the flag exists and points to CA_PATH.
# Strategy:
#   - If any --client-ca-file appears, normalize it to the desired path.
#   - If none appears, add it to the command line args for kube-apiserver.

if grep -q -- "--client-ca-file" "${APISERVER_MANIFEST}"; then
  # Normalize existing flag(s) to the desired path
  sed -E "s#(--client-ca-file=)[^[:space:]]*#\1${CA_PATH}#g" "${APISERVER_MANIFEST}" > "${TMP_MANIFEST}"
else
  # Insert flag into args list. We try to add a new '- --client-ca-file=...' line
  # after the first '- --secure-port=' or similar existing arg, falling back to
  # appending inside the args list.
  if grep -qE '^\s*- --secure-port=' "${APISERVER_MANIFEST}"; then
    awk -v ca="--client-ca-file=${CA_PATH}" '
      /^\s*- --secure-port=/ && !added {
        print
        print "    - " ca
        added=1
        next
      }
      { print }
    ' "${APISERVER_MANIFEST}" > "${TMP_MANIFEST}"
  else
    # Generic append inside args: block
    awk -v ca="--client-ca-file=${CA_PATH}" '
      $0 ~ /^\s*args:\s*$/ && !added {
        print
        getline
        print
        print "    - " ca
        added=1
        next
      }
      { print }
    ' "${APISERVER_MANIFEST}" > "${TMP_MANIFEST}"
  fi
fi

mv "${TMP_MANIFEST}" "${APISERVER_MANIFEST}"

echo "[*] Updated ${APISERVER_MANIFEST}. kubelet will restart the kube-apiserver static pod automatically."
echo "    NOTE: This restarts the API server on this control plane node."

# Wait briefly for kube-apiserver to restart and stabilize
sleep 15

echo "[*] Verifying kube-apiserver process has --client-ca-file=${CA_PATH}"

if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--client-ca-file=${CA_PATH}"; then
  echo "[OK] kube-apiserver is running with --client-ca-file=${CA_PATH}"
  exit 0
else
  echo "ERROR: kube-apiserver is not running with the expected --client-ca-file flag."
  echo "Current kube-apiserver command line:"
  /bin/ps -ef | grep kube-apiserver | grep -v grep || true
  exit 1
fi