Check ID: apiserver_etcd_cafile_set
Provider: Kubernetes
Service: apiserver
Severity: CRITICAL
Categories: encryption, cluster-security
Resource type: Pod

​
What this check verifies

Kubernetes API server uses an etcd CA file via --etcd-cafile to verify etcd’s TLS certificate. This evaluates whether API server containers specify that CA file, anchoring TLS trust for etcd connections.

​
Risk

Without a validated etcd CA, the API server may accept rogue or intercepted endpoints, undermining:
  • Confidentiality: exposure of cluster data in transit
  • Integrity: tampering with Kubernetes state in etcd
  • Availability: control plane disruption via malicious etcd responses

​
Recommendation

Anchor etcd connections in mutual TLS: provide a trusted CA (--etcd-cafile) and unique client credentials, rotate keys, and prefer strong ciphers. Apply least privilege and network segmentation so only API servers can reach etcd; disable plaintext or unauthenticated access.

​
Remediation

Dashboard steps
  1. SSH to the control plane node running kube-apiserver
  2. Edit /etc/kubernetes/manifests/kube-apiserver.yaml
  3. In spec.containers[0].command, add the flag line: 
    - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
  4. Save the file; the kubelet will restart the API server automatically

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_etcd_cafile_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks