Back to Checks
kubernetes

Etcd pod has client certificate authentication enabled (--client-cert-auth=true)

etcd_client_cert_auth
Service: etcdSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityidentity-accessencryption
Resource Type:Pod

Etcd is configured to require TLS client certificate authentication when the etcd container includes --client-cert-auth, so client access is validated with trusted certificates.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without mTLS client auth, any reachable client can query or mutate etcd:

  • Confidentiality: exposure of Secrets and cluster metadata
  • Integrity: tampering with RBAC, pods, and configs
  • Availability: destructive writes can disrupt the control plane

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks etcd_client_cert_auth

Recommendation

Enforce mutual TLS for etcd clients by requiring validated certificates (--client-cert-auth=true) issued by a trusted CA.

Restrict network access to etcd to API servers, rotate keys regularly, and apply least privilege and separation of duties for certificate management.

Remediation

Terraform

# Enable client certificate authentication on etcd
resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name      = "<example_resource_name>"
    namespace = "kube-system"
  }
  spec {
    container {
      name  = "etcd"
      image = "gcr.io/etcd-development/etcd:v3.5.13"
      command = [
        "etcd",
        "--client-cert-auth=true" # Critical: enables client cert auth to pass the check
      ]
    }
  }
}

Other

1SSH to the control plane node that runs etcd
2Edit the static pod manifest: /etc/kubernetes/manifests/etcd.yaml
3Under spec.containers[0].command (or args), add:
4```
5- --client-cert-auth=true # Critical: enables client certificate authentication
6```
7Save the file; kubelet will restart the etcd pod automatically
8Repeat on each control-plane node hosting an etcd pod

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.etcd.etcd_client import etcd_client


class etcd_client_cert_auth(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in etcd_client.etcd_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Etcd has client certificate authentication enabled in pod {pod.name}."
            )
            for container in pod.containers.values():
                if "--client-cert-auth" not in str(
                    container.command
                ) and "--client-cert-auth=true" not in str(container.command):
                    report.status = "FAIL"
                    report.status_extended = f"Etcd does not have client certificate authentication enabled in pod {pod.name}."
                    break
            findings.append(report)
        return findings

References