API server sets --etcd-certfile and --etcd-keyfile

​

What this check verifies

Kubernetes API server uses TLS for its etcd client connection, signaled by --etcd-certfile and --etcd-keyfile in the API server pod arguments. This evaluates whether client-certificate authentication is configured between the API server and etcd.

​

Risk

Without TLS and client certs, API server-etcd traffic can be intercepted or altered, compromising confidentiality (Secrets, tokens), integrity (state tampering), and availability (control-plane instability). Attackers could perform MITM, exfiltrate data, or inject state to seize cluster control.

​

Recommendation

Enforce mutual TLS between API server and etcd with trusted CAs and unique client certificates. Restrict etcd network access to control-plane nodes, rotate keys, and monitor certificate expiry. Apply least privilege and defense in depth using private networking and firewall policies.

​

Remediation

Dashboard steps

1. SSH to each control plane node
2. Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3. In spec.containers[0].command add:
   • —etcd-certfile=<path/to/client-certificate-file>
   • —etcd-keyfile=<path/to/client-key-file>
4. Save the file; the kubelet will restart the API server with the new flags

​

References

• https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/#limiting-access-of-etcd-clusters

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_etcd_tls_config. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks