Securing etcd
etcd is a key-value store that is used by Kubernetes for data storage. It stores the state, configuration, and secrets of the Kubernetes cluster. Only kube-apiserver should have access to etcd. Compromise of etcd can lead to a cluster compromise.
To secure etcd, you should do the following:
- Restrict node access: Use Linux firewalls to ensure that only nodes that need access to
etcdare allowed access. - Ensure the API server uses TLS:
--cert-fileand--key-fileensure that requests toetcdare secure. - Use valid certificates:
--client-cert-authensures that communication from clients is made using valid certificates, and setting--auto-tlstofalseensures that self-signed certificates are not used. - Encrypt data at rest:
--encryption-provider-configis passed to the API server to ensure that data is encrypted at rest inetcd.
On Minikube, the etcd configuration looks like this:
$ ps aux | grep etcd root ...
