Certificate authority is not unique

This product is not supported for your selected Datadog site. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: cb7e695d-6a85-495c-b15f-23aed2519303

Cloud Provider: k8s

Framework: Kubernetes

Severity: Medium

Category: Secret Management

Learn More

Description

The certificate authority should be unique for etcd.

Compliant Code Examples

apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0
      command: ["kube-apiserver"]
      args: ["--client-ca-file=/etc/env/valid.pem"]
  restartPolicy: OnFailure
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: database
spec:
  selector:
    matchLabels:
      app: database
      version: v1
  replicas: 1
  template:
    metadata:
      labels:
        app: database
        version: v1
    spec:
      serviceAccountName: database
      containers:
      - name: database
        image: gcr.io/google_containers/kube-apiserver:certification
        imagePullPolicy: IfNotPresent
        command: ["etcd"]
        args: ["--trusted-ca-file=/etc/env/valid2.pem"]
      nodeSelector:
        kubernetes.io/hostname: worker02  
    restartPolicy: OnFailure

Non-Compliant Code Examples

apiVersion: apps/v1
kind: Deployment
metadata:
  name: database
spec:
  selector:
    matchLabels:
      app: database
      version: v1
  replicas: 1
  template:
    metadata:
      labels:
        app: database
        version: v1
    spec:
      serviceAccountName: database
      containers:
      - name: database
        image: gcr.io/google_containers/kube-apiserver:certification
        imagePullPolicy: IfNotPresent
        command: ["etcd"]
        args: ["--trusted-ca-file=/etc/env/valid3.pem"]
      nodeSelector:
        kubernetes.io/hostname: worker02  
    restartPolicy: OnFailure
---
apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0
      command: ["kube-apiserver"]
      args: ["--client-ca-file=/etc/env/valid3.pem"]
  restartPolicy: OnFailure