The --peer-client-cert-auth argument is not set to True misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_121
Category - Subcategory	Kubernetes - Native Security Controls
Provider	OTHER
Severity	HIGH
Framework	Helm, Kubernetes, Kustomize

Impact

etcd should be configured for peer authentication. etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be accessible only by authenticated etcd peers in the etcd cluster.

How to Fix

Kind: Pod [source,go]

{ "apiVersion: v1 kind: Pod metadata: name: etcd namespace: should-pass spec: hostNetwork: true containers:

• name: "kuku2" image: "b.gcr.io/kuar/etcd:2.2.0" args: ...
• • "--peer-client-cert-auth=true" ...", }

---