documentation_complete: true


title: 'Configure A Unique CA Certificate for etcd'

{{% set etcd_ca_pre_417_path = '/host/etc/kubernetes/static-pod-resources/etcd-certs/configmaps/etcd-serving-ca/ca-bundle.crt' %}}
{{% set etcd_ca_post_417_path = '/host/etc/kubernetes/static-pod-resources/etcd-certs/configmaps/etcd-all-bundles/server-ca-bundle.crt' %}}

description: |-
  A unique CA certificate should be created for <tt>etcd</tt>.  OpenShift by
  default creates separate PKIs for etcd and the Kubernetes API server. The
  same is done for other points of communication in the cluster.

rationale: |-
  The Kubernetes API server and etcd utilize separate CA certificates in
  OpenShift.  This ensures that the etcd data is still protected in the event
  that the API server CA is compromised.

severity: medium

identifiers:
    cce@ocp4: CCE-87514-6

references:
  cis@ocp4: '2.7'
  nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
  nist: CM-6,CM-6(1)
  srg: SRG-APP-000516-CTR-001325

platform: ocp4-master-node

warnings:
  - dependency: |-
      This rule is only applicable for nodes that run the Etcd service.
      The aforementioned service is only running on the nodes labeled
      "master" by default.

ocil_clause: 'The etcd CA certificate is not unique'

ocil: |-
  Run the following command based on your OpenShift version:
  For OpenShift 4.16 and lower:
  <pre>oc debug node/$NODE -- diff {{{ etcd_ca_pre_417_path }}} /host/etc/kubernetes/static-pod-resources/kube-apiserver-certs/configmaps/client-ca/ca-bundle.crt</pre>

  For OpenShift 4.17 and higher:
  <pre>oc debug node/$NODE -- diff {{{ etcd_ca_post_417_path }}} /host/etc/kubernetes/static-pod-resources/kube-apiserver-certs/configmaps/client-ca/ca-bundle.crt</pre>

  where <tt>$NODE</tt> is a master node. If you don't see diff output
  the differences, you might have a compromise and should isolate the cluster.
  OpenShift will use separate PKIs by default.
