Ensure the --cert-file and --key-file arguments are set appropriately

Error: The --cert-file and --key-file arguments are not set appropriately

Bridgecrew Policy ID: BC_K8S_89
Checkov Check ID: CKV_K8S_116
Severity: High

The --cert-file and --key-file arguments are not set appropriately

Description

Configure TLS encryption for the etcd service. etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be encrypted in transit.

Fix - Buildtime

Kubernetes

  • Kind: Pod
apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-apiserver
    tier: control-plane
  name: kube-apiserver
  namespace: kube-system
spec:
  containers:
  - command:
+   - kube-apiserver
+   - --etcd-certfile=/path/to/cert
+   - --etcd-keyfile=/path/to/key
    image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0

Did this page help you?