What it does. Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation. Use when auditing or hardening a control plane, reviewing whether Secrets are encrypted at rest, or protecting etcd backups, since etcd stores Secrets, RBAC policy, and ConfigMaps in plaintext by default. Keywords: etcd, EncryptionConfiguration, encryption at rest, peer TLS, snapshot, backup, control plane. Do not use for broad cluster-wide CIS checks - use performing-kubernetes-cis-benchmark-with-kube-bench. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-kubernetes-etcd-security-assessment, or copy the skill folder into ~/.claude/skills/performing-kubernetes-etcd-security-assessment/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-etcd-security-assessment/SKILL.md

SKILL.md (verbatim)

name: performing-kubernetes-etcd-security-assessment
description: >-
  Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest,
  TLS peer and client transport, access control, backup encryption, and network isolation. Use
  when auditing or hardening a control plane, reviewing whether Secrets are encrypted at rest,
  or protecting etcd backups, since etcd stores Secrets, RBAC policy, and ConfigMaps in
  plaintext by default. Keywords: etcd, EncryptionConfiguration, encryption at rest, peer TLS,
  snapshot, backup, control plane. Do not use for broad cluster-wide CIS checks - use
  performing-kubernetes-cis-benchmark-with-kube-bench.
domain: cybersecurity
subdomain: container-security
tags:
- kubernetes
- etcd
- encryption
- tls
- security-assessment
- backup
- secrets
- control-plane
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.IR-01
- ID.AM-08
- DE.CM-01
mitre_attack:
- T1610
- T1611
- T1609
- T1525
- T1573

Performing Kubernetes etcd Security Assessment

Overview

etcd is the distributed key-value store that serves as Kubernetes' backing store for all cluster data, including Secrets, RBAC policies, ConfigMaps, and workload configurations. Without proper hardening, etcd exposes all cluster secrets in plaintext, making it the highest-value target for attackers who gain control plane access. A comprehensive security assessment covers encryption at rest, TLS for transport, access control, backup security, and network isolation.

When to Use

• When conducting security assessments that involve performing kubernetes etcd security assessment
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Access to Kubernetes control plane nodes
• SSH access to etcd cluster nodes (or etcdctl configured)
• CIS Kubernetes Benchmark reference document
• Understanding of TLS certificate management and EncryptionConfiguration

Assessment Areas

1. Encryption at Rest

Verify that Kubernetes encrypts Secret data stored in etcd:

# Check if EncryptionConfiguration is configured on API server
ps aux | grep kube-apiserver | grep encryption-provider-config

# View the encryption configuration
cat /etc/kubernetes/enc/encryption-config.yaml

Expected secure configuration:

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
      - configmaps
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <base64-encoded-32-byte-key>
      - identity: {}  # Fallback for reading unencrypted data

Verify secrets are actually encrypted in etcd:

# Read a secret directly from etcd
ETCDCTL_API=3 etcdctl \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  get /registry/secrets/default/my-secret | hexdump -C | head -20

# If encrypted, output starts with "k8s:enc:aescbc:v1:key1"
# If NOT encrypted, you'll see plaintext key-value pairs

2. TLS Transport Security

# Verify etcd uses TLS for client connections
ETCDCTL_API=3 etcdctl endpoint health \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# Check peer TLS configuration
ps aux | grep etcd | tr ' ' '\n' | grep -E "peer-cert|peer-key|peer-trusted-ca"

# Verify certificate expiration
openssl x509 -in /etc/kubernetes/pki/etcd/server.crt -noout -enddate
openssl x509 -in /etc/kubernetes/pki/etcd/peer.crt -noout -enddate

Expected flags:

3. Access Control

# Verify etcd is not exposed on all interfaces
ps aux | grep etcd | tr ' ' '\n' | grep listen-client-urls
# Should be: https://127.0.0.1:2379 (not 0.0.0.0)

# Check who can access etcd certificates
ls -la /etc/kubernetes/pki/etcd/
# Should be readable only by root/etcd user

# Verify API server is the only etcd client
ss -tlnp | grep 2379
# Only kube-apiserver should have connections

4. Backup Security

# Create an encrypted etcd backup
ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# Encrypt the backup file
gpg --symmetric --cipher-algo AES256 /backup/etcd-snapshot.db

# Verify backup integrity
ETCDCTL_API=3 etcdctl snapshot status /backup/etcd-snapshot.db --write-out=table

5. Network Isolation

# Verify etcd ports are firewalled
iptables -L -n | grep -E "2379|2380"

# Check if etcd is accessible from worker nodes (should NOT be)
# Run from a worker node:
curl -k https://<control-plane-ip>:2379/health
# Should be rejected/timeout

CIS Benchmark Checks

Key Rotation Procedure

# 1. Generate new encryption key
NEW_KEY=$(head -c 32 /dev/urandom | base64)

# 2. Update EncryptionConfiguration with new key first
cat > /etc/kubernetes/enc/encryption-config.yaml <<EOF
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
    providers:
      - aescbc:
          keys:
            - name: key2
              secret: ${NEW_KEY}
            - name: key1
              secret: <old-key>
      - identity: {}
EOF

# 3. Restart API server to pick up new config
# 4. Re-encrypt all secrets with new key
kubectl get secrets --all-namespaces -o json | \
  kubectl replace -f -

# 5. Remove old key from EncryptionConfiguration
# 6. Restart API server again

References

• Kubernetes etcd Encryption Documentation
• CIS Kubernetes Benchmark - etcd Controls
• Securing etcd - K8s Security Guide
• Infosec: Encryption and etcd

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

etcd Security Assessment Template

Cluster Information

Assessment Results

Sign-Off

references/api-reference.md (verbatim)

API Reference — Performing Kubernetes etcd Security Assessment

Libraries Used

• subprocess: Execute kubectl, etcdctl commands
• json: Parse Kubernetes API resource output
• re: Extract etcd server URLs from API server arguments

CLI Interface

python agent.py [--kubeconfig ~/.kube/config] encrypt
python agent.py access --endpoint https://127.0.0.1:2379 [--cert client.crt --key client.key --cacert ca.crt]
python agent.py secrets
python agent.py tls
python agent.py full [--endpoint https://127.0.0.1:2379]

Core Functions

check_etcd_encryption(kubeconfig) — Verify encryption at rest

Inspects kube-apiserver pod args for --encryption-provider-config, audit logging, TLS.

check_etcd_access(endpoint, cert, key, cacert) — Test access controls

Uses etcdctl to check health and test for unauthenticated read access. CRITICAL finding if data readable without credentials.

dump_secrets_check(kubeconfig) — Audit stored secrets

Lists all cluster secrets, categorizes by type, identifies sensitive naming patterns.

check_etcd_tls_config() — Verify TLS certificates

Checks etcd pod args for peer TLS, client TLS, and client certificate authentication.

full_assessment(kubeconfig, endpoint) — Comprehensive security scan

Combines all checks into single report with risk level classification.

Security Checks

Dependencies

System: kubectl, etcdctl (etcd client) No Python packages required.

references/standards.md (verbatim)

Standards - etcd Security Assessment

CIS Kubernetes Benchmark v1.9 - Section 2: etcd

• 2.1: Ensure cert-file and key-file arguments are set
• 2.2: Ensure client-cert-auth argument is set to true
• 2.3: Ensure auto-tls argument is not set to true
• 2.4: Ensure peer-cert-file and peer-key-file arguments are set
• 2.5: Ensure peer-client-cert-auth argument is set to true
• 2.6: Ensure peer-auto-tls argument is not set to true
• 2.7: Ensure a unique Certificate Authority is used for etcd

NIST SP 800-190

• Section 3.4.4: Data store encryption requirements
• Section 4.4.2: Secrets management for orchestrators

Compliance Mapping

references/workflows.md (verbatim)

Workflows - etcd Security Assessment

Assessment Workflow

1. Verify etcd TLS configuration (client and peer)
2. Check encryption at rest configuration
3. Validate secrets are encrypted in etcd storage
4. Audit network access restrictions to etcd ports
5. Review etcd certificate expiration dates
6. Validate backup encryption and storage security
7. Test key rotation procedure
8. Document findings and remediation plan

Remediation Priority

1. Enable TLS for all etcd communication (Critical)
2. Configure encryption at rest for secrets (Critical)
3. Restrict network access to etcd (High)
4. Implement automated backup encryption (High)
5. Schedule certificate rotation (Medium)
6. Deploy etcd monitoring and alerting (Medium)

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.