Home / Knowledge hub / etcd exposure
Knowledge hub
etcd exposure
An open Kubernetes data store, which holds the cluster's secrets and state.
What it means
etcd is the key-value database where Kubernetes keeps its state: every object, every configuration and, unless encryption is set up, every Secret. The API server is the front door to it. Etcd exposure means other things can reach it directly.
It listens on port 2379 for clients by default. If that port is open to a wide network, or access does not require a client certificate, anyone who finds it can read and sometimes write the cluster's state.
Why it matters
Reading etcd is reading the cluster. That includes secrets, service account tokens and the full workload layout. Writing to it can add workloads or change permissions without going through any of the normal checks.
Backups of etcd carry the same data. A copy left in an open storage bucket is as serious as an exposed port. Treat the data store as the most sensitive part of the cluster.
How it shows up
Managed Kubernetes services normally hide etcd from you, which removes much of this risk. It matters most when you run the control plane yourself. Require mutual TLS with client certificates between etcd and the API server, and restrict the network so only the API server can reach it.
Mistakes include binding to all interfaces, running without client authentication, putting etcd on the same flat network as workloads, and unencrypted backups. Also turn on encryption at rest for Secrets so a leaked copy is not plain text.
Questions people ask
etcd exposure, answered
What does etcd store?
All cluster state: objects, configuration, Secrets, role bindings and more. It is the source of truth for the cluster.
Is etcd exposed on managed Kubernetes?
Usually not to you or to others, because the provider runs it. Check your provider's documentation for what they manage.
How do we secure it?
Use TLS with client certificate authentication, limit network access to the API server, encrypt Secrets at rest and protect backups.
How would someone find it?
By scanning for the default port on your addresses, or by reaching it from a compromised pod on a flat network.
Is an exposed etcd the same as an exposed API server?
No, but both are serious. The API server enforces access rules. Etcd does not, so direct access skips them.
Sources
Where this comes from
Related
Terms that sit next to this one
Kubernetes secrets
Kubernetes objects for passwords and keys, stored encoded but not encrypted by default.
Kubernetes
A system that runs and manages containers across many machines.
Cluster hardening
Tightening a Kubernetes setup against published good-practice benchmarks.
Encryption at rest
Stored data scrambled so a stolen disk is useless without the key.
Kubelet API exposure
An open node-level Kubernetes API that can run commands in pods.
Who can reach your data store?
Open interfaces and leaked secrets are things we look for from the outside. Each finding carries the evidence we collected. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.