> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Etcd Peer-Auto-TLS Argument Is Not Set To True

### More Info:

The --peer-auto-tls argument must not be set to true, as it makes etcd use automatically generated self-signed certificates for peer connections. This bypasses proper certificate authentication between etcd nodes.

### Risk Level

Critical

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every etcd (control plane) node, back up the existing manifest:

        ```bash theme={null}
        sudo cp -p /etc/kubernetes/manifests/etcd.yaml /etc/kubernetes/manifests/etcd.yaml.bak
        ```

        2. On every etcd node, open the manifest for editing:

        ```bash theme={null}
        sudo vi /etc/kubernetes/manifests/etcd.yaml
        ```

        3. In the `spec.containers[].command` (or `args`) section for the `etcd` container, locate any `--peer-auto-tls` entry. Either delete that argument line entirely or change it to:

        ```yaml theme={null}
        - --peer-auto-tls=false
        ```

        Save and exit the editor.

        4. Be aware: editing `/etc/kubernetes/manifests/etcd.yaml` causes the kubelet to restart the etcd static pod on that node. Allow a few moments for the etcd container to restart and stabilize.

        5. On every etcd node, verify etcd was restarted and that `--peer-auto-tls` is not set to true:

        ```bash theme={null}
        ps -ef | grep etcd | grep -v grep
        ```

        Confirm that:

        * there is no `--peer-auto-tls=true` in the process arguments, and
        * if `--peer-auto-tls` appears, it is `--peer-auto-tls=false` (or the flag is absent).
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify the etcd static pod manifest or its process flags. This finding must be fixed by editing `/etc/kubernetes/manifests/etcd.yaml` directly on every etcd (control plane) node; see the Manual Steps section for the exact host-level changes and verification.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix: Ensure etcd --peer-auto-tls argument is not set to true
        # Scope: every etcd node (control plane nodes)
        # Run on: each control plane node with root privileges
        #
        # Idempotent: safe to run multiple times
        # Note: Editing /etc/kubernetes/manifests/etcd.yaml will restart the etcd static pod via kubelet.

        set -euo pipefail

        ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"
        BACKUP_DIR="/etc/kubernetes/manifests/backup-peer-auto-tls-$(date +%Y%m%d-%H%M%S)"

        echo "[INFO] Starting etcd --peer-auto-tls remediation"

        if [[ ! -f "$ETCD_MANIFEST" ]]; then
          echo "[ERROR] Etcd manifest not found at $ETCD_MANIFEST"
          exit 1
        fi

        # Create a timestamped backup directory and backup file (only once per run)
        mkdir -p "$BACKUP_DIR"
        cp -p "$ETCD_MANIFEST" "$BACKUP_DIR/etcd.yaml"
        echo "[INFO] Backup of etcd manifest created at $BACKUP_DIR/etcd.yaml"

        TMP_FILE="$(mktemp)"
        trap 'rm -f "$TMP_FILE"' EXIT

        # 1) Remove any explicit --peer-auto-tls (regardless of value)
        # 2) Then ensure --peer-auto-tls=false is present exactly once in the etcd container args.
        #
        # We:
        # - delete all occurrences of "--peer-auto-tls=..." from the file
        # - then add a single "--peer-auto-tls=false" arg to the etcd container if absent
        #
        # This approach is line-based and does not depend on a particular YAML key order.

        # Step 1: Remove any existing --peer-auto-tls from the manifest
        sed -E 's/--peer-auto-tls(=[^" ]*)?//g' "$ETCD_MANIFEST" > "$TMP_FILE"

        # Step 2: Ensure a single "--peer-auto-tls=false" in the etcd container args list
        #
        # We insert it after the first occurrence of "etcd" container command/arg line that
        # already has another --peer- flag, or after the "image: etcd" line as a fallback.
        #
        # This is best-effort while keeping the script pure bash/sed/awk and idempotent.

        # Check if the cleaned file already contains --peer-auto-tls=false
        if ! grep -q -- '--peer-auto-tls=false' "$TMP_FILE"; then
          awk '
            # State tracking
            /name:[[:space:]]*etcd/ { in_etcd_container=1 }
            in_etcd_container && /name:[[:space:]]*[A-Za-z0-9_-]+/ && !/name:[[:space:]]*etcd/ { in_etcd_container=0 }
            {
              print $0
              # Heuristic 1: insert after an args/command line with another --peer- flag
              if (in_etcd_container && $0 ~ /--peer-/ && $0 !~ /--peer-auto-tls/) {
                # infer indentation from current line
                match($0, /^[[:space:]]*/)
                indent = substr($0, RSTART, RLENGTH)
                print indent "--peer-auto-tls=false"
                in_etcd_container=0
              }
            }
          ' "$TMP_FILE" > "${TMP_FILE}.2"

          # If still not present (heuristic 1 failed), do a simpler injection:
          if ! grep -q -- '--peer-auto-tls=false' "${TMP_FILE}.2"; then
            awk '
              /name:[[:space:]]*etcd/ { in_etcd_container=1 }
              in_etcd_container && /image:/ && /etcd/ {
                print $0
                # add a minimal args list line with --peer-auto-tls=false
                # user may refine args ordering later if desired
                match($0, /^[[:space:]]*/)
                indent = substr($0, RSTART, RLENGTH)
                print indent "command:"
                print indent "- etcd"
                print indent "- --peer-auto-tls=false"
                in_etcd_container=0
                next
              }
              {
                print $0
              }
            ' "${TMP_FILE}.2" > "${TMP_FILE}.3"
            FINAL="${TMP_FILE}.3"
          else
            FINAL="${TMP_FILE}.2"
          fi
        else
          FINAL="$TMP_FILE"
        fi

        # Install the modified manifest
        cp -p "$FINAL" "$ETCD_MANIFEST"
        echo "[INFO] Updated $ETCD_MANIFEST with --peer-auto-tls=false and removed any true values"

        echo "[INFO] Waiting 10 seconds for kubelet to reload the static pod manifest and restart etcd if needed..."
        sleep 10

        # Verification: ensure etcd is not running with --peer-auto-tls=true
        echo "[INFO] Verifying that etcd is not running with --peer-auto-tls=true"
        if /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep | /bin/grep -q -- '--peer-auto-tls=true'; then
          echo "[FAIL] etcd is still running with --peer-auto-tls=true"
          /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
          exit 1
        fi

        # Optional: show current etcd process args for confirmation
        /bin/ps -ef | /bin/grep etcd | /bin/grep -v grep || true

        echo "[OK] Remediation complete: --peer-auto-tls is not set to true on this node."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>