domains / families / security / performing-kubernetes-etcd-security-assessment

performing-kubernetes-etcd-security-assessment

separate

Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation. Use when auditing or hardening a control plane, reviewing whether Secrets are encrypted at rest, or protecting etcd backups, since etcd stores Secrets, RBAC policy, and ConfigMaps in plaintext by default. Keywords: etcd, EncryptionConfiguration, encryption at rest, peer TLS, snapshot, backup, control plane. Do not use for broad cluster-wide CIS checks - use performing-kubernetes-cis-benchmark-with-kube-bench.

When to use

• When conducting security assessments that involve performing kubernetes etcd security assessment
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

When not to use

• broad cluster-wide CIS checks

Skill page

Source