mirror of
https://github.com/aquasecurity/kube-hunter.git
synced 2026-08-21 05:06:32 +00:00
20 lines
737 B
Markdown
20 lines
737 B
Markdown
---
|
|
vid: KHV032
|
|
title: Etcd Remote Read Access Event
|
|
categories: [Access Risk]
|
|
---
|
|
|
|
# {{ page.vid }} - {{ page.title }}
|
|
|
|
## Issue description
|
|
|
|
Etcd (Kubernetes' Database) is accessible without authentication. This exposes the entire state of your Kubernetes cluster to the reader.
|
|
|
|
## Remediation
|
|
|
|
Ensure your etcd is accepting connections only from the Kubernetes API, using the `--trusted-ca-file` etcd flag. This is usually done by the installer, or cloud platform.
|
|
|
|
## References
|
|
|
|
- [etcd - Transport security model](https://etcd.io/docs/v3.4.0/op-guide/security/)
|
|
- [Operating etcd clusters for Kubernetes - Securing etcd clusters](https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/#securing-etcd-clusters) |