Etcd Peer Client Certificate Authentication Set To False
- Query id: b7d0181d-0a9b-4611-9d1c-1ad4f0b620ff
- Query name: Etcd Peer Client Certificate Authentication Set To False
- Platform: Kubernetes
- Severity: Medium
- Category: Secret Management
- CWE: 287
- URL: Github
Description¶
When using etcd commands, the '--peer-client-cert-auth' flag should be set to true
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Positive test num. 1 - yaml file
apiVersion: apps/v1
kind: Deployment
metadata:
name: app-etcd-deployment
spec:
selector:
matchLabels:
app: app
replicas: 1
template:
metadata:
labels:
app: app
version: v1
spec:
serviceAccountName: database
containers:
- name: database
image: gcr.io/google_containers/etcd:v3.2.18
imagePullPolicy: IfNotPresent
command: ["etcd"]
args: ["--peer-client-cert-auth=false"]
nodeSelector:
kubernetes.io/hostname: worker02
restartPolicy: OnFailure
Positive test num. 2 - yaml file
apiVersion: apps/v1
kind: Deployment
metadata:
name: app-etcd-deployment
spec:
selector:
matchLabels:
app: app
replicas: 1
template:
metadata:
labels:
app: app
version: v1
spec:
serviceAccountName: database
containers:
- name: database
image: gcr.io/google_containers/etcd:v3.2.18
imagePullPolicy: IfNotPresent
command: ["etcd"]
args: []
nodeSelector:
kubernetes.io/hostname: worker02
restartPolicy: OnFailure
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
apiVersion: apps/v1
kind: Deployment
metadata:
name: app-etcd-deployment
spec:
selector:
matchLabels:
app: app
replicas: 1
template:
metadata:
labels:
app: app
version: v1
spec:
serviceAccountName: database
containers:
- name: database
image: gcr.io/google_containers/etcd:v3.2.18
imagePullPolicy: IfNotPresent
command: ["etcd"]
args: ["--peer-client-cert-auth=true"]
nodeSelector:
kubernetes.io/hostname: worker02
restartPolicy: OnFailure