Ensure Peer Auto Tls Argument Is Disabled

More Info:

Do not use automatically generated self-signed certificates for TLS connections between peers.

Risk Level

Low

Address

Security

Compliance Standards

• CIS Kubernetes

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every etcd (control plane) node, back up the current etcd static pod manifest:

sudo cp -a /etc/kubernetes/manifests/etcd.yaml /etc/kubernetes/manifests/etcd.yaml.bak.$(date +%F-%H%M%S)

2. Open the etcd manifest for editing:

sudo vi /etc/kubernetes/manifests/etcd.yaml

3. In the command or args list for the etcd container, locate any --peer-auto-tls entry and either delete that line or set it explicitly to false, for example:

    - --peer-auto-tls=false

Ensure there is no remaining --peer-auto-tls=true in the file. Save and exit the editor.
Note: editing this file will cause the kubelet to restart the etcd static pod.

4. Wait for the etcd pod to be recreated and confirm it is running (on the control plane node):

sudo crictl ps | grep etcd

5. On the same node, verify the running etcd process no longer has --peer-auto-tls=true and, if present, is set to false:

/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep

6. Inspect the command line shown and confirm that:

• there is no --peer-auto-tls=true, and
• if --peer-auto-tls appears, it is --peer-auto-tls=false.

Using kubectl

kubectl cannot modify the etcd static pod manifest or its process flags. To remediate this finding, you must edit /etc/kubernetes/manifests/etcd.yaml directly on every etcd (control plane) node; follow the guidance in the Manual Steps section for the exact host-level changes.

Automation

#!/usr/bin/env bash
#
# Disable etcd --peer-auto-tls on all control plane nodes by editing
# /etc/kubernetes/manifests/etcd.yaml.
#
# Usage (from any machine with SSH access to control-plane nodes):
#   CONTROL_PLANE_NODES=("cp-node-1" "cp-node-2") ./fix-etcd-peer-auto-tls.sh
#
# Requirements:
#   - SSH access as a user with sudo privileges on each control-plane node
#   - Bash, sed, grep on remote nodes

set -euo pipefail

if [ "${CONTROL_PLANE_NODES-}" = "" ]; then
  echo "ERROR: Set CONTROL_PLANE_NODES array in the environment, e.g.:"
  echo '  CONTROL_PLANE_NODES=("cp-node-1" "cp-node-2") ./fix-etcd-peer-auto-tls.sh'
  exit 1
fi

# Convert environment array to bash array in this script context
# shellcheck disable=SC2206
NODES=(${CONTROL_PLANE_NODES})

remote_fix_node() {
  local NODE="$1"

  echo "==== Processing control-plane node: ${NODE} ===="

  ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "${NODE}" /bin/bash -s << 'EOF'
set -euo pipefail

ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"

if [ ! -f "${ETCD_MANIFEST}" ]; then
  echo "WARN: ${ETCD_MANIFEST} not found on this node; skipping."
  exit 0
fi

echo "Backing up ${ETCD_MANIFEST} to ${ETCD_MANIFEST}.bak"
sudo cp -p "${ETCD_MANIFEST}" "${ETCD_MANIFEST}.bak"

TMP_ETCD_MANIFEST="$(mktemp)"
trap 'rm -f "${TMP_ETCD_MANIFEST}"' EXIT

# Normalize: ensure there is exactly one --peer-auto-tls flag and it is set to false.
# Strategy:
#   1. Remove any existing --peer-auto-tls occurrences completely.
#   2. Ensure we add --peer-auto-tls=false under the etcd container args list
#      if an args list exists; otherwise, do not fabricate structure (admin may add manually).

# Step 1: remove any existing --peer-auto-tls occurrences
sed -E 's/--peer-auto-tls(=true|=false)? ?//g' "${ETCD_MANIFEST}" > "${TMP_ETCD_MANIFEST}"

# Step 2: add --peer-auto-tls=false if we can safely detect the args block
# We look for the first occurrence of the etcd container args list and append
# a new line with - --peer-auto-tls=false if it is not already present.
if grep -qE '^\s*- --peer-auto-tls=false\s*$' "${TMP_ETCD_MANIFEST}"; then
  echo "--peer-auto-tls=false already present; no addition needed."
else
  if grep -qE '^\s*args:\s*$' "${TMP_ETCD_MANIFEST}"; then
    echo "Inserting - --peer-auto-tls=false into existing args list."
    # Insert the flag as the first arg under the first args: block
    awk '
      BEGIN { inserted=0 }
      /^ *args: *$/ && inserted==0 {
        print $0
        # determine indentation for args values
        match($0, /^([[:space:]]*)args:[[:space:]]*$/, m)
        indent=m[1]"  "
        print indent"- --peer-auto-tls=false"
        inserted=1
        next
      }
      { print $0 }
    ' "${TMP_ETCD_MANIFEST}" > "${TMP_ETCD_MANIFEST}.new"
    mv "${TMP_ETCD_MANIFEST}.new" "${TMP_ETCD_MANIFEST}"
  else
    echo "NOTE: No args: list detected; not inserting --peer-auto-tls=false automatically."
    echo "      The existing manifest will now have any --peer-auto-tls flags removed."
  fi
fi

echo "Writing updated manifest to ${ETCD_MANIFEST}"
sudo cp "${TMP_ETCD_MANIFEST}" "${ETCD_MANIFEST}"

echo "Waiting 5 seconds for the kubelet to restart the etcd static pod (if needed)..."
sleep 5

echo "Verifying that etcd is no longer started with --peer-auto-tls=true ..."
if /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep | /bin/grep -q -- '--peer-auto-tls=true'; then
  echo "ERROR: etcd still running with --peer-auto-tls=true on this node."
  exit 1
fi

if /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep | /bin/grep -q -- '--peer-auto-tls=false'; then
  echo "OK: etcd is running with --peer-auto-tls=false on this node."
else
  echo "OK: etcd is running without --peer-auto-tls=true on this node (flag absent or false)."
fi
EOF

  echo "==== Completed: ${NODE} ===="
}

for NODE in "${NODES[@]}"; do
  remote_fix_node "${NODE}"
done

echo "All specified control-plane nodes processed."

Additional Reading:

• https://coreos.com/etcd/docs/latest/op-guide/security.html