Back to Checks
kubernetes

API server pod has the --encryption-provider-config argument set

apiserver_encryption_provider_config_set
Service: apiserverSeverity: high
OfficialBuilt-inVerified
Categories:encryptioncluster-security
Resource Type:Pod

Kubernetes API server pods include --encryption-provider-config, supplying an EncryptionConfiguration to apply encryption at rest to selected API resources stored in etcd.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Absent an encryption provider, Secrets and credentials are stored in plaintext in etcd and backups. Access to etcd, control plane disks, or snapshots can expose keys and tokens, enabling unauthorized API calls and lateral movement, compromising confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_encryption_provider_config_set

Recommendation

Enable encryption at rest with an EncryptionConfiguration and run with --encryption-provider-config using a non-identity provider (prefer kms v2). Apply least privilege to key/KMS access, rotate keys, restrict config file access, keep settings consistent across API servers, and re-encrypt existing objects.

Remediation

Other

1SSH to each control-plane node
2Create the encryption config file at /etc/kubernetes/enc/enc.yaml:
3```yaml
4apiVersion: apiserver.config.k8s.io/v1
5kind: EncryptionConfiguration
6resources:
7- resources: ["secrets"]
8providers:
9- aescbc:
10keys:
11- name: key1
12secret: <BASE64_32_BYTE_KEY>
13- identity: {}
14```
15Edit /etc/kubernetes/manifests/kube-apiserver.yaml and:
16- Add the flag under the kube-apiserver container command:
17```
18- --encryption-provider-config=/etc/kubernetes/enc/enc.yaml
19```
20- Mount the config path:
21```yaml
22volumeMounts:
23- name: enc
24mountPath: /etc/kubernetes/enc
25readOnly: true
26...
27volumes:
28- name: enc
29hostPath:
30path: /etc/kubernetes/enc
31type: DirectoryOrCreate
32```
33Save the file; the kubelet will restart the API server.
34Repeat on all control-plane nodes.

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_encryption_provider_config_set(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Encryption provider config is set appropriately in pod {pod.name}."
            )

            encryption_provider_config_set = True
            for container in pod.containers.values():
                # Check if "--encryption-provider-config" is set
                if "--encryption-provider-config" not in str(container.command):
                    encryption_provider_config_set = False
                    break

            if not encryption_provider_config_set:
                report.status = "FAIL"
                report.status_extended = (
                    f"Encryption provider config is not set in pod {pod.name}."
                )

            findings.append(report)
        return findings

References