Check ID: etcd_peer_client_cert_auth
Provider: Kubernetes
Service: etcd
Severity: HIGH
Categories: cluster-security, identity-access
Resource type: Pod

​
What this check verifies

Etcd requires peer client certificate authentication for inter-member traffic via --peer-client-cert-auth=true set in the etcd container command

​
Risk

Without peer authentication, a rogue host can impersonate a member, eavesdrop on or alter Raft traffic, inject state, and disrupt elections-compromising confidentiality (state leakage), integrity (malicious writes), and availability (cluster instability/outage).

​
Recommendation

Enforce mTLS for etcd peers with client certificate auth. Use a dedicated CA, validate SANs, and apply least privilege to issued certs. Rotate and revoke certificates regularly, restrict network access to peer ports, and avoid auto-generated self-signed peer TLS to maintain strong identity assurance.

​
Remediation

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name      = "<example_resource_name>"
    namespace = "kube-system"
  }
  spec {
    container {
      name    = "etcd"
      image   = "registry.k8s.io/etcd:3.5.12-0"
      command = [
        "etcd",
        "--peer-client-cert-auth=true"  # Critical: enables peer client certificate authentication for peer traffic
      ]
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = etcd_peer_client_cert_auth. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks