etcd peer auto TLS is enabled

Description

--peer-auto-tls=true generates self-signed certificates for etcd peer connections. It can encrypt traffic, but does not itself authenticate trusted peers.

Peer communication carries replication and cluster operations. Where authentication is required, verify peer identity with managed CAs and peer certificates.

Potential impact

• Without peer verification, an attacker on a reachable network can attempt to impersonate a peer.
• Disabling automatic TLS before preparing its replacement can interrupt encryption or peer connectivity.

Remediation

• First prepare managed peer certificates and keys, --peer-trusted-ca-file and HTTPS peer addresses.
• Require trusted certificates with --peer-client-cert-auth=true, then disable automatic TLS as you switch to the prepared configuration.
• Test member communication and certificate rejection, and establish a renewal process.

Examples

These partial historical examples show etcd 3.2.18 arguments. Actual deployments need a supported version and complete peer TLS configuration.

Before

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-etcd-deployment
spec:
  template:
    spec:
      containers:
        - name: database
          image: gcr.io/google_containers/etcd:v3.2.18
          command: ["etcd"]
          args: ["--peer-auto-tls=true"]

Automatically generated self-signed certificates are used for peer connections. This setting alone does not authenticate peer identity.

After

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-etcd-deployment
spec:
  template:
    spec:
      containers:
        - name: database
          image: gcr.io/google_containers/etcd:v3.2.18
          command: ["etcd"]
          args: []

Only the automatic TLS argument is removed. Configure certificates, keys, CA trust and HTTPS peer addresses separately to retain protected connections.

References

• CWE-295
• etcd security guide