Back to Checks
kubernetes

Etcd pod has --auto-tls disabled

etcd_no_auto_tls
Service: etcdSeverity: high
OfficialBuilt-inVerified
Categories:encryptioncluster-security
Resource Type:Pod

Etcd configuration is reviewed for the --auto-tls option, which enables automatically generated self-signed certificates for client TLS.

Presence of this flag indicates self-signed TLS is used; absence indicates client TLS relies on externally managed certificates.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Using self-signed auto TLS weakens identity assurance, enabling spoofed endpoints and man-in-the-middle on etcd client traffic. Attackers could read or alter Kubernetes state in etcd, impacting confidentiality and integrity, and facilitating control-plane takeover or data exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks etcd_no_auto_tls

Recommendation

Disable --auto-tls and use CA-signed certificates with mutual TLS for etcd clients. Apply managed PKI to enforce trusted CAs, rotate and revoke keys, and prefer modern TLS versions and strong cipher suites. Monitor certificate expiry and limit access per least privilege for defense in depth.

Remediation

Other

1SSH to the control plane node running etcd
2Edit the static Pod manifest: sudo vi /etc/kubernetes/manifests/etcd.yaml
3In containers -> command or args, remove any occurrence of --auto-tls or --auto-tls=true (do not set it to false)
4Save and exit; kubelet will recreate the etcd pod automatically
5Verify the flag is absent: kubectl -n kube-system get pod -l component=etcd -o yaml | grep -q "auto-tls" || echo "PASS: --auto-tls not set"

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.etcd.etcd_client import etcd_client


class etcd_no_auto_tls(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in etcd_client.etcd_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Etcd is not configured to use self-signed certificates for TLS in pod {pod.name}."
            for container in pod.containers.values():
                if "--auto-tls" in str(container.command) or "--auto-tls=true" in str(
                    container.command
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Etcd is configured to use self-signed certificates for TLS in pod {pod.name}."
                    break
            findings.append(report)
        return findings

References