Back to Checks
kubernetes

Etcd pod uses TLS for peer connections

etcd_peer_tls_config
Service: etcdSeverity: high
OfficialBuilt-inVerified
Categories:encryptioncluster-security
Resource Type:Pod

Etcd peer communication is treated as secure when TLS is configured with a peer certificate and key (e.g., --peer-cert-file and --peer-key-file). The assessment inspects etcd containers for these options to determine whether server-to-server traffic is encrypted and authenticated.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without TLS on peer links, attackers can intercept or alter Raft traffic, enabling node impersonation and consensus manipulation. This endangers confidentiality (exposed cluster state), integrity (tampered writes), and availability (quorum disruption), cascading into control-plane instability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks etcd_peer_tls_config

Recommendation

Enforce TLS for etcd peer communication with unique certificates per member and mutual authentication. Apply strong cipher suites and modern protocol versions, rotate keys, and separate CAs for peers and clients. Limit network access to peer ports to trusted nodes, following least privilege and defense in depth.

Remediation

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    container {
      name  = "etcd"
      image = "quay.io/coreos/etcd:latest"
      command = [
        "etcd",
        "--peer-cert-file=</path/to/peer-cert-file>", # Critical: enables TLS for peer connections
        "--peer-key-file=</path/to/peer-key-file>"   # Critical: key for the peer TLS cert
      ]
    }
  }
}

Other

1SSH to the control plane node running etcd
2Open /etc/kubernetes/manifests/etcd.yaml
3Under spec.containers[0].command add:
4- --peer-cert-file=</path/to/peer-cert-file>
5- --peer-key-file=</path/to/peer-key-file>
6Save the file; kubelet will restart the etcd Pod automatically
7Verify the etcd container command includes both flags

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.etcd.etcd_client import etcd_client


class etcd_peer_tls_config(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in etcd_client.etcd_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Etcd is configured with TLS for peer connections in pod {pod.name}."
            )
            for container in pod.containers.values():
                if "--peer-cert-file" not in str(
                    container.command
                ) and "--peer-key-file" not in str(container.command):
                    report.status = "FAIL"
                    report.status_extended = f"Etcd does not have TLS configured for peer connections in pod {pod.name}."
                    break
            findings.append(report)
        return findings

References