Check ID: etcd_no_peer_auto_tls
Provider: Kubernetes
Service: etcd
Severity: HIGH
Categories: encryption, cluster-security
Resource type: Pod

​
What this check verifies

Etcd peer TLS configuration is evaluated by checking etcd containers for the --peer-auto-tls flag. Presence of --peer-auto-tls indicates peers use automatically generated self-signed certificates for inter-peer connections.

​
Risk

With --peer-auto-tls, traffic is encrypted but peer identity isn’t verified, enabling:
  • MITM on peer links
  • Rogue member joins to read/modify data
  • Quorum disruption
This degrades confidentiality, integrity, and availability of control-plane state replicated in etcd.

​
Recommendation

Disable --peer-auto-tls and use mTLS with a trusted CA issuing unique per-member peer certificates. Enforce SAN validation and, where supported, peer certificate authentication. Apply least privilege, separate CAs for peers/clients, rotate keys, and monitor certificate expiry and peer membership.

​
Remediation

Dashboard steps
  1. SSH to the control-plane node running etcd
  2. Open /etc/kubernetes/manifests/etcd.yaml
  3. In the etcd container args/command, remove any entry that starts with —peer-auto-tls
  4. Save the file; the kubelet will restart etcd automatically

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = etcd_no_peer_auto_tls. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks