Etcd TLS Certificate Files Not Properly Set
- Query id: 075ca296-6768-4322-aea2-ba5063b969a9
- Query name: Etcd TLS Certificate Files Not Properly Set
- Platform: Kubernetes
- Severity: High
- Category: Networking and Firewall
- URL: Github
Description¶
When using etcd commands, the '--cert-file' and '--key-file' should be defined
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
apiVersion: apps/v1
kind: Deployment
metadata:
name: app-etcd-deployment
spec:
selector:
matchLabels:
app: app
replicas: 1
template:
metadata:
labels:
app: app
version: v1
spec:
serviceAccountName: database
containers:
- name: database
image: gcr.io/google_containers/etcd:v3.2.18
imagePullPolicy: IfNotPresent
command: ["etcd"]
args: ["--cert-file=/etc/env/file.crt"]
nodeSelector:
kubernetes.io/hostname: worker02
restartPolicy: OnFailure
Postitive test num. 2 - yaml file
apiVersion: apps/v1
kind: Deployment
metadata:
name: app-etcd-deployment
spec:
selector:
matchLabels:
app: app
replicas: 1
template:
metadata:
labels:
app: app
version: v1
spec:
serviceAccountName: database
containers:
- name: database
image: gcr.io/google_containers/etcd:v3.2.18
imagePullPolicy: IfNotPresent
command: ["etcd"]
args: ["--key-file=/etc/env/file2.key"]
nodeSelector:
kubernetes.io/hostname: worker02
restartPolicy: OnFailure
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
apiVersion: apps/v1
kind: Deployment
metadata:
name: app-etcd-deployment
spec:
selector:
matchLabels:
app: app
replicas: 1
template:
metadata:
labels:
app: app
version: v1
spec:
serviceAccountName: database
containers:
- name: database
image: gcr.io/google_containers/etcd:v3.2.18
imagePullPolicy: IfNotPresent
command: ["etcd"]
args: ["--cert-file=/etc/env/file.crt", "--key-file=/etc/env/file2.key"]
nodeSelector:
kubernetes.io/hostname: worker02
restartPolicy: OnFailure
Negative test num. 2 - yaml file
apiVersion: apps/v1
kind: Deployment
metadata:
name: app-etcd-deployment
spec:
selector:
matchLabels:
app: app
replicas: 1
template:
metadata:
labels:
app: app
version: v1
spec:
serviceAccountName: database
containers:
- name: database
image: gcr.io/google_containers/etcd:v3.2.18
imagePullPolicy: IfNotPresent
command: ["etcd", "--cert-file=/etc/env/file.crt", "--key-file=/etc/env/file2.key"]
args: []
nodeSelector:
kubernetes.io/hostname: worker02
restartPolicy: OnFailure