Ensure Etcd Auto-TLS Argument Is Not Set To True

More Info:

The --auto-tls argument must not be set to true, as it makes etcd generate and use self-signed certificates for client connections. This bypasses proper certificate-based authentication and exposes etcd data.

Risk Level

Critical

Address

Security

Compliance Standards

• CIS Kubernetes

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every etcd (control plane) node, back up the existing manifest so you can roll back if needed:

   sudo cp -a /etc/kubernetes/manifests/etcd.yaml /etc/kubernetes/manifests/etcd.yaml.bak.$(date +%F-%H%M%S)

2. On every etcd node, open the etcd static pod manifest for editing:

   sudo vi /etc/kubernetes/manifests/etcd.yaml

   In the spec.containers[].command (or args) section:

   • Remove any --auto-tls=true argument, or
   • If you must keep the flag, change it explicitly to:

     - --auto-tls=false

3. Save the file and exit the editor. The kubelet will automatically detect the manifest change and restart the etcd static pod; this causes an etcd restart on that control plane node.

4. On every etcd node, wait a few seconds, then verify etcd is running without --auto-tls=true:

   ps -ef | grep etcd | grep -v grep

   Confirm that:

   • There is no --auto-tls=true in the process command line, and
   • If --auto-tls appears, it is --auto-tls=false or the flag is absent.

Using kubectl

kubectl cannot change the etcd static pod manifest or its process flags. This finding must be remediated by editing /etc/kubernetes/manifests/etcd.yaml directly on every etcd (control plane) node; see the Manual Steps section for the exact host-level procedure.

Automation

#!/usr/bin/env bash
#
# Remediation: Ensure Etcd --auto-tls argument is not set to true
# Scope: every etcd node (control plane nodes running /etc/kubernetes/manifests/etcd.yaml)
#
# Usage: run as root on each control plane node
#   sudo bash fix-etcd-auto-tls.sh
#
# Operational impact:
#   - Editing /etc/kubernetes/manifests/etcd.yaml will cause the kubelet
#     to restart the etcd static pod.

set -euo pipefail

ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-etcd-auto-tls-$(date +%Y%m%d%H%M%S)"

echo "==> Etcd auto-tls remediation starting"

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: This script must be run as root." >&2
  exit 1
fi

if [[ ! -f "$ETCD_MANIFEST" ]]; then
  echo "No etcd manifest found at $ETCD_MANIFEST; nothing to do on this node."
  exit 0
fi

mkdir -p "$BACKUP_DIR"
cp -p "$ETCD_MANIFEST" "$BACKUP_DIR/etcd.yaml"
echo "Backup created at $BACKUP_DIR/etcd.yaml"

TMP_MANIFEST="$(mktemp)"
cp -p "$ETCD_MANIFEST" "$TMP_MANIFEST"

# 1) Normalize any existing --auto-tls flag to false
#    - Replace occurrences of --auto-tls=true with --auto-tls=false
sed -i 's/--auto-tls[[:space:]]*=[[:space:]]*true/--auto-tls=false/g' "$TMP_MANIFEST"

# 2) Ensure we do NOT have an explicit "true" flag without '=' (e.g. "--auto-tls true")
#    Convert such forms to "--auto-tls=false"
sed -i 's/--auto-tls[[:space:]]\+true/--auto-tls=false/g' "$TMP_MANIFEST"

# 3) If there is no --auto-tls flag at all, we leave it that way (removal is acceptable)
if ! grep -q -- "--auto-tls" "$TMP_MANIFEST"; then
  echo "No --auto-tls flag present; this is already compliant."
else
  echo "Ensured any existing --auto-tls flag is set to false in manifest."
fi

# Only overwrite the live manifest if there is a change
if cmp -s "$ETCD_MANIFEST" "$TMP_MANIFEST"; then
  echo "Manifest is already in desired state; no changes applied."
  rm -f "$TMP_MANIFEST"
else
  mv "$TMP_MANIFEST" "$ETCD_MANIFEST"
  echo "Updated $ETCD_MANIFEST. Kubelet will restart the etcd static pod automatically."
fi

echo "==> Waiting for etcd process to reflect configuration change..."

# Wait loop: give kubelet time to restart etcd and then verify
MAX_WAIT_SEC=120
SLEEP_SEC=5
elapsed=0
success=0

while [[ $elapsed -lt $MAX_WAIT_SEC ]]; do
  if /bin/ps -ef | /bin/grep "[e]tcd" >/dev/null 2>&1; then
    # Check that --auto-tls is not set to true in the running process
    if ! /bin/ps -ef | /bin/grep "[e]tcd" | /bin/grep -q -- "--auto-tls=true"; then
      success=1
      break
    fi
  fi
  sleep "$SLEEP_SEC"
  elapsed=$((elapsed + SLEEP_SEC))
done

echo "==> Verification: running etcd processes and their auto-tls flags:"
/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep || true

if [[ $success -eq 1 ]]; then
  echo "COMPLIANT: No etcd process is running with --auto-tls=true."
  exit 0
else
  echo "WARNING: etcd process still appears with --auto-tls=true or has not restarted yet." >&2
  echo "Review $ETCD_MANIFEST and the etcd container logs; you may need to investigate manually." >&2
  exit 1
fi