이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다. Id: kubernetes-auto-tls-set-to-true
Platform: Kubernetes
Severity: Medium
Category: Networking and Firewall
Learn More Description When a container runs etcd, the --auto-tls flag should be set to false or omitted. Enabling --auto-tls=true enables automatic certificate management and can introduce security risks. This rule checks containers and initContainers for commands that invoke etcd and reports when --auto-tls is present and set to true.
Compliant Code Examples apiVersion : apps/v1
kind : Deployment
metadata :
name : app-etcd-deployment
spec :
selector :
matchLabels :
app : app
replicas : 1
template :
metadata :
labels :
app : app
version : v1
spec :
serviceAccountName : database
containers :
- name : database
image : gcr.io/google_containers/etcd:v3.2.18
imagePullPolicy : IfNotPresent
command : [ "etcd" ]
args : []
nodeSelector :
kubernetes.io/hostname : worker02
restartPolicy : OnFailure
apiVersion : apps/v1
kind : Deployment
metadata :
name : app-etcd-deployment
spec :
selector :
matchLabels :
app : app
replicas : 1
template :
metadata :
labels :
app : app
version : v1
spec :
serviceAccountName : database
containers :
- name : database
image : gcr.io/google_containers/etcd:v3.2.18
imagePullPolicy : IfNotPresent
command : [ "etcd" , "--auto-tls=false" ]
args : []
nodeSelector :
kubernetes.io/hostname : worker02
restartPolicy : OnFailure
Non-Compliant Code Examples apiVersion : apps/v1
kind : Deployment
metadata :
name : app-etcd-deployment
spec :
selector :
matchLabels :
app : app
replicas : 1
template :
metadata :
labels :
app : app
version : v1
spec :
serviceAccountName : database
containers :
- name : database
image : gcr.io/google_containers/etcd:v3.2.18
imagePullPolicy : IfNotPresent
command : [ "etcd" ]
args : [ "--auto-tls=true" ]
nodeSelector :
kubernetes.io/hostname : worker02
restartPolicy : OnFailure
