Best practices

K8S API server configuration not using –etcd-cafile parameter

Risk Level

Informational (4)

  • N/A


etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be protected by client authentication. This requires the API server to identify itself to the etcd server using a SSL Certificate Authority file. Orca has detected that the '--etcd-cafile' parameter is not set.
  • Recommended Mitigation

    It is recommended to set the '--etcd-cafile' parameter in the configuration file to a valid file.