Ensure the --cert-file and --key-file arguments are set appropriately
Error: The --cert-file and --key-file arguments are not set appropriately
Bridgecrew Policy ID: BC_K8S_89
Checkov Check ID: CKV_K8S_116
Severity: High
The --cert-file and --key-file arguments are not set appropriately
Description
Configure TLS encryption for the etcd service. etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be encrypted in transit.
Fix - Buildtime
Kubernetes
- Kind: Pod
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
component: kube-apiserver
tier: control-plane
name: kube-apiserver
namespace: kube-system
spec:
containers:
- command:
+ - kube-apiserver
+ - --etcd-certfile=/path/to/cert
+ - --etcd-keyfile=/path/to/key
image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0
Updated 12 months ago