Skip to main content

​
More Info:

A dedicated —trusted-ca-file should be used for etcd so it does not share a certificate authority with the wider cluster. Using a separate CA limits the blast radius if another components CA is compromised.

​
Risk Level

High

​
Address

Security

​
Compliance Standards

  • CIS Kubernetes

​
Triage and Remediation

​
Remediation

Using Console

Refer to the remediation guidance for this control. Detailed console, CLI and Python steps are being generated.