> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Etcd Cafile Argument Is Appropriate

### More Info:

etcd should be configured to make use of TLS encryption for client connections.

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, confirm the current kube-apiserver manifest and running args:
           ```bash theme={null}
           sudo cat /etc/kubernetes/manifests/kube-apiserver.yaml
           /bin/ps -ef | grep kube-apiserver | grep -v grep
           ```

        2. Ensure you have a CA file that issued the etcd server/client certificates (replace the path below with the actual CA if different):
           ```bash theme={null}
           ls -l /etc/kubernetes/pki/etcd/ca.crt
           sudo chmod 600 /etc/kubernetes/pki/etcd/ca.crt
           sudo chown root:root /etc/kubernetes/pki/etcd/ca.crt
           ```

        3. Edit the kube-apiserver static pod manifest on every control plane node to add or correct the `--etcd-cafile` flag (this edit will automatically restart the kube-apiserver container when the file is saved):
           ```bash theme={null}
           sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
           ```
           Under `spec.containers[0].command`, ensure there is a line similar to:
           ```yaml theme={null}
           - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
           ```
           Save and exit the editor.

        4. (If etcd is external and using different CA) Adjust the path in step 3 to the correct etcd CA file, and make sure the file exists and is readable by root:
           ```bash theme={null}
           ls -l /path/to/etcd-ca.crt
           sudo chmod 600 /path/to/etcd-ca.crt
           sudo chown root:root /path/to/etcd-ca.crt
           ```

        5. Wait for the kubelet to detect the manifest change and restart the kube-apiserver pod. Confirm the pod is running:
           ```bash theme={null}
           sudo crictl ps | grep kube-apiserver || sudo docker ps | grep kube-apiserver
           ```

        6. Verify the kube-apiserver is now started with the correct `--etcd-cafile` argument on every control plane node:
           ```bash theme={null}
           /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -- '--etcd-cafile='
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify the kube-apiserver static pod manifest or its process flags, so it cannot be used to set the `--etcd-cafile` argument. To remediate this finding, you must edit `/etc/kubernetes/manifests/kube-apiserver.yaml` directly on every control plane node as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix: Ensure kube-apiserver is configured with --etcd-cafile
        # Scope: every control plane node
        #
        # Requirements:
        #   - Run as root on each control plane node
        #   - Static pod manifest at /etc/kubernetes/manifests/kube-apiserver.yaml
        #   - etcd CA file present at /etc/kubernetes/pki/etcd/ca.crt (adjust ETCD_CA_FILE below if different)

        set -euo pipefail

        MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
        BACKUP_DIR="/etc/kubernetes/manifests/backup-$(date +%Y%m%d)"
        ETCD_CA_FILE="/etc/kubernetes/pki/etcd/ca.crt"

        echo "[INFO] Verifying prerequisites..."

        if [[ $EUID -ne 0 ]]; then
          echo "[ERROR] This script must be run as root." >&2
          exit 1
        fi

        if [[ ! -f "$MANIFEST" ]]; then
          echo "[ERROR] kube-apiserver manifest not found at $MANIFEST" >&2
          exit 1
        fi

        if [[ ! -f "$ETCD_CA_FILE" ]]; then
          echo "[ERROR] Etcd CA file not found at $ETCD_CA_FILE" >&2
          echo "[HINT] Place the correct etcd CA file on this node and update ETCD_CA_FILE in this script if needed." >&2
          exit 1
        fi

        mkdir -p "$BACKUP_DIR"
        BACKUP_FILE="$BACKUP_DIR/kube-apiserver.yaml.$(date +%H%M%S)"
        cp -p "$MANIFEST" "$BACKUP_FILE"
        echo "[INFO] Backup created at $BACKUP_FILE"

        echo "[INFO] Ensuring --etcd-cafile is configured in kube-apiserver manifest..."

        # If argument already present, update its value in-place; otherwise, add it.
        if grep -q -- "--etcd-cafile=" "$MANIFEST"; then
          # Idempotent replacement of existing value
          sed -i "s#--etcd-cafile=.*#--etcd-cafile=${ETCD_CA_FILE}#g" "$MANIFEST"
        else
          # Insert argument under the 'command:' section for kube-apiserver
          # This keeps the YAML valid and is safe to re-run (guarded by grep above).
          awk -v cafile="$ETCD_CA_FILE" '
            $0 ~ /- kube-apiserver$/ && in_cmd == 0 {
              print $0
              in_cmd=1
              next
            }
            in_cmd == 1 && $0 ~ /^ *-/ {
              # First argument line after the binary; insert our flag before it once
              if (!inserted) {
                print "    - --etcd-cafile=" cafile
                inserted=1
              }
              print $0
              next
            }
            { print $0 }
            END {
              if (!inserted) {
                # If we never saw arguments, append the flag at the end of the file
                print "    - --etcd-cafile=" cafile
              }
            }
          ' "$MANIFEST" > "${MANIFEST}.tmp" && mv "${MANIFEST}.tmp" "$MANIFEST"
        fi

        echo "[INFO] Manifest updated. kube-apiserver static pod will be restarted automatically by kubelet."

        echo "[INFO] Waiting for kube-apiserver process to reflect new flag..."
        # Give kubelet time to restart the static pod
        sleep 20

        # Verification: confirm kube-apiserver is running with the correct --etcd-cafile argument
        echo "[INFO] Verifying kube-apiserver process flags..."
        if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--etcd-cafile=${ETCD_CA_FILE}"; then
          echo "[SUCCESS] kube-apiserver is running with --etcd-cafile=${ETCD_CA_FILE}"
          exit 0
        else
          echo "[ERROR] kube-apiserver is NOT running with the expected --etcd-cafile flag." >&2
          echo "[INFO] Current kube-apiserver process line(s):" >&2
          /bin/ps -ef | grep kube-apiserver | grep -v grep >&2
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)