Securing etcd

etcd is a key-value store that is used by Kubernetes for data storage. It stores the state, configuration, and secrets of the Kubernetes cluster. Only kube-apiserver should have access to etcd. Compromise of etcd can lead to a cluster compromise.

To secure etcd, you should do the following:

• Restrict node access: Use Linux firewalls to ensure that only nodes that need access to etcd are allowed access.
• Ensure the API server uses TLS: --cert-file and --key-file ensure that requests to etcd are secure.
• Use valid certificates: --client-cert-auth ensures that communication from clients is made using valid certificates, and setting --auto-tls to false ensures that self-signed certificates are not used.
• Encrypt data at rest: --encryption-provider-config is passed to the API server to ensure that data is encrypted at rest in etcd.

On Minikube, the etcd configuration looks like this:

$ ps aux | grep etcd
root      ...