Skip to main content

Ensure Auto Tls Argument Is Disabled

More Info:​

Do not use self-signed certificates for TLS.

Risk Level​

High

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every etcd (control plane) node, back up the current etcd static pod manifest:

    sudo cp -a /etc/kubernetes/manifests/etcd.yaml /etc/kubernetes/manifests/etcd.yaml.backup.$(date +%F-%H%M%S)

  2. Open /etc/kubernetes/manifests/etcd.yaml for editing:

    sudo vi /etc/kubernetes/manifests/etcd.yaml

  3. In the container command/args list for etcd, locate any --auto-tls flag and either:

    • remove the entire --auto-tls=... entry, or
    • change it explicitly to false, for example: 
      - --auto-tls=false

  4. Save the file and exit the editor. The kubelet will automatically restart the etcd static pod when it detects the manifest change (this temporarily restarts etcd on this node).

  5. After 30–60 seconds, verify on the same node that etcd is running without --auto-tls=true:

    /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep

  6. Inspect the output and confirm there is no --auto-tls=true argument present in the etcd process command line (and, if present, it is --auto-tls=false or absent entirely). Repeat these steps on every etcd node.

Using kubectl

kubectl cannot change the etcd process flags or the static pod manifest at /etc/kubernetes/manifests/etcd.yaml on the control plane node. To remediate this finding, you must edit that file directly on every etcd node; see the Manual Steps section.

Automation
#!/usr/bin/env bash
#
# Remediation: Disable etcd --auto-tls on all control plane nodes
# Scope: Run on every control plane node that has /etc/kubernetes/manifests/etcd.yaml
# Impact: Editing /etc/kubernetes/manifests/etcd.yaml will trigger a restart
#         of the etcd static pod via the kubelet on that node.

set -euo pipefail

ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-etcd-auto-tls-$(date +%Y%m%d-%H%M%S)"

echo "[*] Checking for etcd manifest at ${ETCD_MANIFEST}..."
if [[ ! -f "${ETCD_MANIFEST}" ]]; then
  echo "[!] etcd manifest not found at ${ETCD_MANIFEST}. Nothing to do on this node."
  exit 0
fi

echo "[*] Creating backup directory ${BACKUP_DIR}..."
mkdir -p "${BACKUP_DIR}"
cp -p "${ETCD_MANIFEST}" "${BACKUP_DIR}/"

echo "[*] Ensuring --auto-tls is disabled in ${ETCD_MANIFEST}..."

# 1. Remove any existing --auto-tls flag lines to avoid duplicates or conflicting values.
#    This is done conservatively: only lines containing '--auto-tls' are removed.
tmpfile="$(mktemp)"
grep -v -- '--auto-tls' "${ETCD_MANIFEST}" > "${tmpfile}"

# 2. Insert --auto-tls=false into the etcd command args if not present.
#    We look for an existing 'etcd' container command/args section and add it.
#    If the manifest does not have a suitable place, we leave the file as-is
#    (very unlikely for standard kubeadm-style manifests).
if ! grep -q -- '--auto-tls=false' "${tmpfile}"; then
  # Try to inject into an existing args list for the etcd container.
  # This awk script:
  #  - Tracks when we are inside the etcd container definition.
  #  - When we see a line with '- --client-cert-auth' or similar args lines,
  #    we append a new arg line '- --auto-tls=false' once.
  awk '
    /name: etcd/ { in_etcd=1 }
    in_etcd && $1 == "name:" && $2 != "etcd" { in_etcd=0 }
    {
      print $0
      if (in_etcd && $1 == "-" && $2 ~ /^--/ && inserted == 0) {
        # Heuristic: insert right after the first arg line encountered.
        print "        - --auto-tls=false"
        inserted=1
      }
    }
    END {
      if (in_etcd && inserted == 0) {
        # Fallback: if we never saw an args line, append one at the end of the etcd container
        # This is best-effort and assumes standard indentation.
        # No-op in most kubeadm-generated manifests where we will have inserted earlier.
      }
    }
  ' "${tmpfile}" > "${tmpfile}.patched" || {
    echo "[!] Failed to patch manifest; restoring original."
    cp -p "${BACKUP_DIR}/etcd.yaml" "${ETCD_MANIFEST}"
    rm -f "${tmpfile}" "${tmpfile}.patched"
    exit 1
  }
  mv "${tmpfile}.patched" "${tmpfile}"
fi

# 3. Move patched file into place (atomic replace).
cp -p "${tmpfile}" "${ETCD_MANIFEST}"
rm -f "${tmpfile}"

echo "[*] Updated ${ETCD_MANIFEST}. kubelet will restart the etcd static pod automatically."

# Wait briefly for etcd to restart (tunable).
sleep 10

echo "[*] Verifying that etcd is not running with --auto-tls=true..."

# Verification: use the same style as the audit command and ensure no etcd process has --auto-tls=true
if /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep | /bin/grep -q -- "--auto-tls=true"; then
  echo "[!] Verification FAILED: etcd is still running with --auto-tls=true on this node."
  echo "    Check the manifest and kubelet status manually."
  exit 2
fi

if /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep | /bin/grep -q -- "--auto-tls=false"; then
  echo "[*] Verification PASSED: etcd is running with --auto-tls=false (or not set) on this node."
else
  echo "[*] Verification PASSED: etcd is running without --auto-tls flag (default is disabled)."
fi

exit 0

Additional Reading:​