> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Etcd Auto-TLS Argument Is Not Set To True

### More Info:

The --auto-tls argument must not be set to true, as it makes etcd generate and use self-signed certificates for client connections. This bypasses proper certificate-based authentication and exposes etcd data.

### Risk Level

Critical

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every etcd (control plane) node, back up the existing manifest so you can roll back if needed:
           ```bash theme={null}
           sudo cp -a /etc/kubernetes/manifests/etcd.yaml /etc/kubernetes/manifests/etcd.yaml.bak.$(date +%F-%H%M%S)
           ```

        2. On every etcd node, open the etcd static pod manifest for editing:
           ```bash theme={null}
           sudo vi /etc/kubernetes/manifests/etcd.yaml
           ```
           In the `spec.containers[].command` (or `args`) section:
           * Remove any `--auto-tls=true` argument, **or**
           * If you must keep the flag, change it explicitly to:
             ```yaml theme={null}
             - --auto-tls=false
             ```

        3. Save the file and exit the editor. The kubelet will automatically detect the manifest change and restart the etcd static pod; this causes an etcd restart on that control plane node.

        4. On every etcd node, wait a few seconds, then verify etcd is running without `--auto-tls=true`:
           ```bash theme={null}
           ps -ef | grep etcd | grep -v grep
           ```
           Confirm that:
           * There is no `--auto-tls=true` in the process command line, and
           * If `--auto-tls` appears, it is `--auto-tls=false` or the flag is absent.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change the etcd static pod manifest or its process flags. This finding must be remediated by editing `/etc/kubernetes/manifests/etcd.yaml` directly on every etcd (control plane) node; see the Manual Steps section for the exact host-level procedure.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediation: Ensure Etcd --auto-tls argument is not set to true
        # Scope: every etcd node (control plane nodes running /etc/kubernetes/manifests/etcd.yaml)
        #
        # Usage: run as root on each control plane node
        #   sudo bash fix-etcd-auto-tls.sh
        #
        # Operational impact:
        #   - Editing /etc/kubernetes/manifests/etcd.yaml will cause the kubelet
        #     to restart the etcd static pod.

        set -euo pipefail

        ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"
        BACKUP_DIR="/etc/kubernetes/manifests/backup-etcd-auto-tls-$(date +%Y%m%d%H%M%S)"

        echo "==> Etcd auto-tls remediation starting"

        if [[ $EUID -ne 0 ]]; then
          echo "ERROR: This script must be run as root." >&2
          exit 1
        fi

        if [[ ! -f "$ETCD_MANIFEST" ]]; then
          echo "No etcd manifest found at $ETCD_MANIFEST; nothing to do on this node."
          exit 0
        fi

        mkdir -p "$BACKUP_DIR"
        cp -p "$ETCD_MANIFEST" "$BACKUP_DIR/etcd.yaml"
        echo "Backup created at $BACKUP_DIR/etcd.yaml"

        TMP_MANIFEST="$(mktemp)"
        cp -p "$ETCD_MANIFEST" "$TMP_MANIFEST"

        # 1) Normalize any existing --auto-tls flag to false
        #    - Replace occurrences of --auto-tls=true with --auto-tls=false
        sed -i 's/--auto-tls[[:space:]]*=[[:space:]]*true/--auto-tls=false/g' "$TMP_MANIFEST"

        # 2) Ensure we do NOT have an explicit "true" flag without '=' (e.g. "--auto-tls true")
        #    Convert such forms to "--auto-tls=false"
        sed -i 's/--auto-tls[[:space:]]\+true/--auto-tls=false/g' "$TMP_MANIFEST"

        # 3) If there is no --auto-tls flag at all, we leave it that way (removal is acceptable)
        if ! grep -q -- "--auto-tls" "$TMP_MANIFEST"; then
          echo "No --auto-tls flag present; this is already compliant."
        else
          echo "Ensured any existing --auto-tls flag is set to false in manifest."
        fi

        # Only overwrite the live manifest if there is a change
        if cmp -s "$ETCD_MANIFEST" "$TMP_MANIFEST"; then
          echo "Manifest is already in desired state; no changes applied."
          rm -f "$TMP_MANIFEST"
        else
          mv "$TMP_MANIFEST" "$ETCD_MANIFEST"
          echo "Updated $ETCD_MANIFEST. Kubelet will restart the etcd static pod automatically."
        fi

        echo "==> Waiting for etcd process to reflect configuration change..."

        # Wait loop: give kubelet time to restart etcd and then verify
        MAX_WAIT_SEC=120
        SLEEP_SEC=5
        elapsed=0
        success=0

        while [[ $elapsed -lt $MAX_WAIT_SEC ]]; do
          if /bin/ps -ef | /bin/grep "[e]tcd" >/dev/null 2>&1; then
            # Check that --auto-tls is not set to true in the running process
            if ! /bin/ps -ef | /bin/grep "[e]tcd" | /bin/grep -q -- "--auto-tls=true"; then
              success=1
              break
            fi
          fi
          sleep "$SLEEP_SEC"
          elapsed=$((elapsed + SLEEP_SEC))
        done

        echo "==> Verification: running etcd processes and their auto-tls flags:"
        /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep || true

        if [[ $success -eq 1 ]]; then
          echo "COMPLIANT: No etcd process is running with --auto-tls=true."
          exit 0
        else
          echo "WARNING: etcd process still appears with --auto-tls=true or has not restarted yet." >&2
          echo "Review $ETCD_MANIFEST and the etcd container logs; you may need to investigate manually." >&2
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>