> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Peer Auto Tls Argument Is Disabled

### More Info:

Do not use automatically generated self-signed certificates for TLS connections between peers.

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every etcd (control plane) node, back up the current etcd static pod manifest:

        ```bash theme={null}
        sudo cp -a /etc/kubernetes/manifests/etcd.yaml /etc/kubernetes/manifests/etcd.yaml.bak.$(date +%F-%H%M%S)
        ```

        2. Open the etcd manifest for editing:

        ```bash theme={null}
        sudo vi /etc/kubernetes/manifests/etcd.yaml
        ```

        3. In the `command` or `args` list for the etcd container, locate any `--peer-auto-tls` entry and either delete that line or set it explicitly to false, for example:

        ```yaml theme={null}
            - --peer-auto-tls=false
        ```

        Ensure there is no remaining `--peer-auto-tls=true` in the file. Save and exit the editor.\
        Note: editing this file will cause the kubelet to restart the etcd static pod.

        4. Wait for the etcd pod to be recreated and confirm it is running (on the control plane node):

        ```bash theme={null}
        sudo crictl ps | grep etcd
        ```

        5. On the same node, verify the running etcd process no longer has `--peer-auto-tls=true` and, if present, is set to false:

        ```bash theme={null}
        /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
        ```

        6. Inspect the command line shown and confirm that:

        * there is no `--peer-auto-tls=true`, and
        * if `--peer-auto-tls` appears, it is `--peer-auto-tls=false`.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify the etcd static pod manifest or its process flags. To remediate this finding, you must edit `/etc/kubernetes/manifests/etcd.yaml` directly on every etcd (control plane) node; follow the guidance in the Manual Steps section for the exact host-level changes.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Disable etcd --peer-auto-tls on all control plane nodes by editing
        # /etc/kubernetes/manifests/etcd.yaml.
        #
        # Usage (from any machine with SSH access to control-plane nodes):
        #   CONTROL_PLANE_NODES=("cp-node-1" "cp-node-2") ./fix-etcd-peer-auto-tls.sh
        #
        # Requirements:
        #   - SSH access as a user with sudo privileges on each control-plane node
        #   - Bash, sed, grep on remote nodes

        set -euo pipefail

        if [ "${CONTROL_PLANE_NODES-}" = "" ]; then
          echo "ERROR: Set CONTROL_PLANE_NODES array in the environment, e.g.:"
          echo '  CONTROL_PLANE_NODES=("cp-node-1" "cp-node-2") ./fix-etcd-peer-auto-tls.sh'
          exit 1
        fi

        # Convert environment array to bash array in this script context
        # shellcheck disable=SC2206
        NODES=(${CONTROL_PLANE_NODES})

        remote_fix_node() {
          local NODE="$1"

          echo "==== Processing control-plane node: ${NODE} ===="

          ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new "${NODE}" /bin/bash -s << 'EOF'
        set -euo pipefail

        ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"

        if [ ! -f "${ETCD_MANIFEST}" ]; then
          echo "WARN: ${ETCD_MANIFEST} not found on this node; skipping."
          exit 0
        fi

        echo "Backing up ${ETCD_MANIFEST} to ${ETCD_MANIFEST}.bak"
        sudo cp -p "${ETCD_MANIFEST}" "${ETCD_MANIFEST}.bak"

        TMP_ETCD_MANIFEST="$(mktemp)"
        trap 'rm -f "${TMP_ETCD_MANIFEST}"' EXIT

        # Normalize: ensure there is exactly one --peer-auto-tls flag and it is set to false.
        # Strategy:
        #   1. Remove any existing --peer-auto-tls occurrences completely.
        #   2. Ensure we add --peer-auto-tls=false under the etcd container args list
        #      if an args list exists; otherwise, do not fabricate structure (admin may add manually).

        # Step 1: remove any existing --peer-auto-tls occurrences
        sed -E 's/--peer-auto-tls(=true|=false)? ?//g' "${ETCD_MANIFEST}" > "${TMP_ETCD_MANIFEST}"

        # Step 2: add --peer-auto-tls=false if we can safely detect the args block
        # We look for the first occurrence of the etcd container args list and append
        # a new line with - --peer-auto-tls=false if it is not already present.
        if grep -qE '^\s*- --peer-auto-tls=false\s*$' "${TMP_ETCD_MANIFEST}"; then
          echo "--peer-auto-tls=false already present; no addition needed."
        else
          if grep -qE '^\s*args:\s*$' "${TMP_ETCD_MANIFEST}"; then
            echo "Inserting - --peer-auto-tls=false into existing args list."
            # Insert the flag as the first arg under the first args: block
            awk '
              BEGIN { inserted=0 }
              /^ *args: *$/ && inserted==0 {
                print $0
                # determine indentation for args values
                match($0, /^([[:space:]]*)args:[[:space:]]*$/, m)
                indent=m[1]"  "
                print indent"- --peer-auto-tls=false"
                inserted=1
                next
              }
              { print $0 }
            ' "${TMP_ETCD_MANIFEST}" > "${TMP_ETCD_MANIFEST}.new"
            mv "${TMP_ETCD_MANIFEST}.new" "${TMP_ETCD_MANIFEST}"
          else
            echo "NOTE: No args: list detected; not inserting --peer-auto-tls=false automatically."
            echo "      The existing manifest will now have any --peer-auto-tls flags removed."
          fi
        fi

        echo "Writing updated manifest to ${ETCD_MANIFEST}"
        sudo cp "${TMP_ETCD_MANIFEST}" "${ETCD_MANIFEST}"

        echo "Waiting 5 seconds for the kubelet to restart the etcd static pod (if needed)..."
        sleep 5

        echo "Verifying that etcd is no longer started with --peer-auto-tls=true ..."
        if /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep | /bin/grep -q -- '--peer-auto-tls=true'; then
          echo "ERROR: etcd still running with --peer-auto-tls=true on this node."
          exit 1
        fi

        if /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep | /bin/grep -q -- '--peer-auto-tls=false'; then
          echo "OK: etcd is running with --peer-auto-tls=false on this node."
        else
          echo "OK: etcd is running without --peer-auto-tls=true on this node (flag absent or false)."
        fi
        EOF

          echo "==== Completed: ${NODE} ===="
        }

        for NODE in "${NODES[@]}"; do
          remote_fix_node "${NODE}"
        done

        echo "All specified control-plane nodes processed."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://coreos.com/etcd/docs/latest/op-guide/security.html](https://coreos.com/etcd/docs/latest/op-guide/security.html)