Kubelet Hostname Override Argument Not Set

#!/usr/bin/env bash
#
# Fix: Ensure kubelet --hostname-override argument is not set
# Scope: every worker node (run on each worker via SSH, or via your config management)
# Safe to re-run (idempotent).

set -euo pipefail

SERVICE_DIR="/etc/systemd/system/kubelet.service.d"
SERVICE_FILE="${SERVICE_DIR}/10-kubeadm.conf"
BACKUP_SUFFIX=".pre-hostname-override-fix.$(date +%Y%m%d%H%M%S)"

echo "[INFO] Running on node: $(hostname -f || hostname)"

# 1. Pre-flight checks
if [[ ! -d "${SERVICE_DIR}" ]]; then
  echo "[ERROR] Directory ${SERVICE_DIR} not found; kubelet may be managed differently on this node."
  echo "[ERROR] This script cannot proceed safely. Review manually."
  exit 1
fi

if [[ ! -f "${SERVICE_FILE}" ]]; then
  echo "[ERROR] Kubelet service drop-in ${SERVICE_FILE} not found."
  echo "[ERROR] This script is tailored to kubeadm-based setups; review manually."
  exit 1
fi

# 2. Backup existing config (once per unique content)
if ! grep -q "pre-hostname-override-fix" <<<"$(ls -1 ${SERVICE_DIR} 2>/dev/null || true)"; then
  cp -p "${SERVICE_FILE}" "${SERVICE_FILE}${BACKUP_SUFFIX}"
  echo "[INFO] Backup created at ${SERVICE_FILE}${BACKUP_SUFFIX}"
else
  echo "[INFO] Backup appears to have been taken previously; skipping new backup."
fi

# 3. Remove --hostname-override from any KUBELET_SYSTEM_PODS_ARGS line
#    - handles with/without value forms like:
#      --hostname-override
#      --hostname-override=foo
#      --hostname-override foo
TMP_FILE="$(mktemp)"
trap 'rm -f "${TMP_FILE}"' EXIT

changed=false

while IFS= read -r line; do
  if [[ "${line}" =~ KUBELET_SYSTEM_PODS_ARGS ]]; then
    orig="${line}"

    # Remove patterns:
    #   --hostname-override
    #   --hostname-override=<value>
    #   --hostname-override <value>
    # Use multiple passes to keep sed expressions simpler and safe.
    line="$(printf '%s\n' "${line}" \
      | sed -E 's/[[:space:]]--hostname-override(=([^"[:space:]]+))?//g' \
      | sed -E 's/--hostname-override[[:space:]]+([^"[:space:]]+)//g')"

    # Normalize any double spaces introduced
    line="$(printf '%s\n' "${line}" | sed -E 's/[[:space:]]+/ /g')"

    # Preserve leading whitespace and quotes exactly; only spaces inside changed.
    # If the line changed, flag it.
    if [[ "${orig}" != "${line}" ]]; then
      changed=true
      echo "[INFO] Removed --hostname-override from KUBELET_SYSTEM_PODS_ARGS"
    fi
  fi
  printf '%s\n' "${line}" >> "${TMP_FILE}"
done < "${SERVICE_FILE}"

if [[ "${changed}" == false ]]; then
  echo "[INFO] No --hostname-override flag found in ${SERVICE_FILE}; nothing to change."
else
  cp -p "${TMP_FILE}" "${SERVICE_FILE}"
  echo "[INFO] Updated ${SERVICE_FILE}"
fi

# 4. Reload systemd and restart kubelet if we changed anything
if [[ "${changed}" == true ]]; then
  echo "[INFO] Reloading systemd daemon and restarting kubelet (this will restart kubelet)."
  systemctl daemon-reload
  systemctl restart kubelet.service
  echo "[INFO] kubelet restarted."
fi

# 5. Verification (matches benchmark audit: /bin/ps -fC kubelet)
echo "[INFO] Verifying that kubelet is not running with --hostname-override..."

if ! /bin/ps -fC kubelet >/dev/null 2>&1; then
  echo "[ERROR] kubelet process not found; verify kubelet service status."
  systemctl status kubelet.service || true
  exit 1
fi

if /bin/ps -fC kubelet | grep -q -- "--hostname-override"; then
  echo "[FAIL] kubelet is still running with --hostname-override:"
  /bin/ps -fC kubelet
  exit 1
fi

echo "[PASS] kubelet is running without --hostname-override."
/bin/ps -fC kubelet