Profile Applicability:

  • Level 2

Description:

The etcd component of Kubernetes stores critical cluster data, including configuration and state information. Using a unique Certificate Authority (CA) for etcd ensures that its communication is securely encrypted and distinct from other parts of the Kubernetes infrastructure. This prevents the potential compromise of etcd data by ensuring that only valid, trusted certificates can be used for communication.

Rationale:

By using a unique Certificate Authority for etcd, you enhance the security of sensitive cluster data. If the CA used for etcd is shared with other Kubernetes components, it could expose etcd to unnecessary risks in the event of a CA compromise. A unique CA ensures that etcd's communication is independently secured, reducing the risk of unauthorized access.

Impact:

Pros:

  • Enhances security by using a dedicated CA for etcd encryption.

  • Prevents potential exposure of critical data due to shared CA vulnerabilities.

Cons:

  • Requires additional management and configuration of certificates and CAs for etcd.

Default Value:

By default, etcd might use the same CA as other Kubernetes components, unless explicitly configured with a unique one.

Pre-requisites:

  • Ensure that a unique CA for etcd is available and properly configured.

  • Validate that etcd is configured to use the unique CA for encryption.

Test Plan:

Using AWS Console:

  1. Sign in to the AWS Management Console.

  2. Navigate to your EKS Cluster or Kubernetes environment.

  3. Go to the etcd configuration settings.

  4. Check the certificate authority configuration for etcd to ensure it is using a unique Certificate Authority.

Using AWS CLI:

Run the following AWS CLI command to describe your EKS cluster's configuration and look for the etcd CA:

aws eks describe-cluster --name <cluster-name> --query "cluster.config"

  1. Verify that the etcd component is using a unique Certificate Authority.

Implementation Plan

Using AWS Console:

  1. Navigate to the EKS cluster in the AWS Console.

  2. Under the Cluster Configuration section, modify the etcd settings to use a unique Certificate Authority.

  3. Save the configuration and apply the changes.

Using AWS CLI:

Update the etcd configuration to use a unique Certificate Authority:

aws eks update-cluster-config --name <cluster-name> --kubernetes-version <kubernetes-version> --etcd-cert-authority <unique-ca-path>

Backout Plan:

Using AWS Console:

  1. Navigate to the etcd configuration in the AWS Console.

  2. If necessary, revert the CA configuration to the shared or default CA.

  3. Save the configuration and redeploy the cluster.

Using AWS CLI:

If issues occur, revert the change using:

aws eks update-cluster-config --name <cluster-name> --kubernetes-version <kubernetes-version> --etcd-cert-authority <previous-ca-path>

References: