Etcd pod has --auto-tls disabled

​

What this check verifies

Etcd configuration is reviewed for the --auto-tls option, which enables automatically generated self-signed certificates for client TLS. Presence of this flag indicates self-signed TLS is used; absence indicates client TLS relies on externally managed certificates.

​

Risk

Using self-signed auto TLS weakens identity assurance, enabling spoofed endpoints and man-in-the-middle on etcd client traffic. Attackers could read or alter Kubernetes state in etcd, impacting confidentiality and integrity, and facilitating control-plane takeover or data exfiltration.

​

Recommendation

Disable --auto-tls and use CA-signed certificates with mutual TLS for etcd clients. Apply managed PKI to enforce trusted CAs, rotate and revoke keys, and prefer modern TLS versions and strong cipher suites. Monitor certificate expiry and limit access per least privilege for defense in depth.

​

Remediation

Dashboard steps

1. SSH to the control plane node running etcd
2. Edit the static Pod manifest: sudo vi /etc/kubernetes/manifests/etcd.yaml
3. In containers -> command or args, remove any occurrence of —auto-tls or —auto-tls=true (do not set it to false)
4. Save and exit; kubelet will recreate the etcd pod automatically
5. Verify the flag is absent: kubectl -n kube-system get pod -l component=etcd -o yaml | grep -q “auto-tls” || echo “PASS: —auto-tls not set”

​

References

• https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/
• https://etcd.io/docs/latest/op-guide/security/
• https://etcd.io/docs/v3.2/op-guide/security/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = etcd_no_auto_tls. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks