Back to Checks
kubernetes

Etcd pod has peer client certificate authentication enabled

etcd_peer_client_cert_auth
Service: etcdSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityidentity-access
Resource Type:Pod

Etcd requires peer client certificate authentication for inter-member traffic via --peer-client-cert-auth=true set in the etcd container command

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without peer authentication, a rogue host can impersonate a member, eavesdrop on or alter Raft traffic, inject state, and disrupt elections-compromising confidentiality (state leakage), integrity (malicious writes), and availability (cluster instability/outage).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks etcd_peer_client_cert_auth

Recommendation

Enforce mTLS for etcd peers with client certificate auth. Use a dedicated CA, validate SANs, and apply least privilege to issued certs. Rotate and revoke certificates regularly, restrict network access to peer ports, and avoid auto-generated self-signed peer TLS to maintain strong identity assurance.

Remediation

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name      = "<example_resource_name>"
    namespace = "kube-system"
  }
  spec {
    container {
      name    = "etcd"
      image   = "registry.k8s.io/etcd:3.5.12-0"
      command = [
        "etcd",
        "--peer-client-cert-auth=true"  # Critical: enables peer client certificate authentication for peer traffic
      ]
    }
  }
}

Other

1SSH to the control-plane node
2Edit the etcd static Pod manifest: /etc/kubernetes/manifests/etcd.yaml
3In spec.containers[0].command, add this entry:
4- --peer-client-cert-auth=true
5(Critical: enables peer client certificate authentication)
6Save the file; the kubelet will automatically restart the etcd Pod
7Verify the Pod's container command includes --peer-client-cert-auth=true

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.etcd.etcd_client import etcd_client


class etcd_peer_client_cert_auth(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in etcd_client.etcd_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Etcd is configured for peer client certificate authentication in pod {pod.name}."
            for container in pod.containers.values():
                if "--peer-client-cert-auth" not in str(
                    container.command
                ) and "--peer-client-cert-auth=true" not in str(container.command):
                    report.status = "FAIL"
                    report.status_extended = f"Etcd does not have peer client certificate authentication configured in pod {pod.name}."
                    break
            findings.append(report)
        return findings

References