Encryption providers are not appropriately configured misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_104
Category - Subcategory	Kubernetes - Native Security Controls
Provider	OTHER
Severity	HIGH
Framework	Helm, Kubernetes, Kustomize

Impact

Where etcd encryption is used, appropriate providers should be configured. Where etcd encryption is used, it is important to ensure that the appropriate set of encryption providers is used. Currently, the aescbc, kms and secretbox are likely to be appropriate options.

How to Fix

Kind: Pod [source,go]

{ "apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers:

• command:
• • kube-apiserver
• • --encryption-provider-config=config.file image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts:
• mountPath: /etc/kubernetes/ name: k8s readOnly: true
• mountPath: /etc/ssl/certs name: certs
• mountPath: /etc/pki name: pki hostNetwork: true volumes:
• hostPath: path: /etc/kubernetes name: k8s
• hostPath: path: /etc/ssl/certs name: certs
• hostPath: path: /etc/pki name: pki ", }

---