Kubelet Make Iptables Util Chains Argument Set To True

#!/usr/bin/env bash
# Purpose: Ensure kubelet has makeIPTablesUtilChains=true via config file
# Scope:   Run on every WORKER NODE (not control plane) as root
# Safe:    Idempotent; can be re-run

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
BACKUP_SUFFIX="$(date +%Y%m%d%H%M%S)"

echo "==> Ensuring kubelet uses makeIPTablesUtilChains=true via config file on worker node"

if [[ ! -f "${KUBELET_CONFIG}" ]]; then
  echo "ERROR: ${KUBELET_CONFIG} not found. This script expects kubelet to use a config file."
  exit 1
fi

# 1) Backup kubelet config once per run
cp -n "${KUBELET_CONFIG}" "${KUBELET_CONFIG}.bak.${BACKUP_SUFFIX}" || true

# 2) Ensure makeIPTablesUtilChains: true exists and is correctly set in the config file
#    - If key exists: force to true
#    - If key missing: append under top-level (simple YAML edit)

if grep -qE '^[[:space:]]*makeIPTablesUtilChains:' "${KUBELET_CONFIG}"; then
  # Replace any existing value with true
  sed -i 's/^[[:space:]]*makeIPTablesUtilChains:.*/makeIPTablesUtilChains: true/' "${KUBELET_CONFIG}"
else
  # Append at end as a top-level key
  printf '\nmakeIPTablesUtilChains: true\n' >> "${KUBELET_CONFIG}"
fi

# 3) If kubelet is using command-line flags, remove explicit --make-iptables-util-chains=
#    from the kubelet systemd drop-in to avoid conflicting with config file
if [[ -f "${SYSTEMD_DROPIN}" ]]; then
  cp -n "${SYSTEMD_DROPIN}" "${SYSTEMD_DROPIN}.bak.${BACKUP_SUFFIX}" || true

  # Remove any --make-iptables-util-chains=... occurrences from lines
  sed -i 's/\s\+--make-iptables-util-chains=[^[:space:]]\+//g' "${SYSTEMD_DROPIN}"
fi

# 4) Reload systemd and restart kubelet (this will briefly disrupt workloads on this node)
echo "==> Restarting kubelet (this restarts the kubelet process)..."
systemctl daemon-reload
systemctl restart kubelet.service

# 5) Verification: confirm kubelet is running and uses makeIPTablesUtilChains=true
echo "==> Verifying kubelet process and configuration..."

# Check process exists
if ! /bin/ps -fC kubelet >/dev/null 2>&1; then
  echo "ERROR: kubelet process not found after restart."
  exit 1
fi

# Verify config file has the correct setting
if ! grep -qE '^[[:space:]]*makeIPTablesUtilChains:[[:space:]]*true[[:space:]]*$' "${KUBELET_CONFIG}"; then
  echo "ERROR: ${KUBELET_CONFIG} does not contain 'makeIPTablesUtilChains: true' after update."
  exit 1
fi

echo "SUCCESS: kubelet is running and ${KUBELET_CONFIG} has makeIPTablesUtilChains: true"
echo "You can also re-run: /bin/ps -fC kubelet"

chmod +x /root/fix-kubelet-iptables-iptables.sh
/root/fix-kubelet-iptables-iptables.sh

/bin/ps -fC kubelet
grep -n 'makeIPTablesUtilChains' /var/lib/kubelet/config.yaml