Lesson 0037 · 15 minutes · Linux performance lab · Cluster Setup

Harden etcd without breaking membership

This is a focused CIS remediation drill. It deliberately removes the cluster-entry and package-installation friction from the previous attempt.

Scope discipline: change only the insecure transport, authentication, and metrics flags. Preserve identity, data, listen/advertise peer addresses, initial cluster membership, certificates, mounts, and image.

Task

On the Linux lab shell, create /tmp/lesson-37-etcd.yaml from lab/lesson-37-etcd-insecure.yaml. Make it pass the supplied verifier.

Require client and peer client certificates.
Disable automatic TLS for both client and peer traffic.
Keep the existing explicit CA, certificate, and key paths.
Ensure client traffic uses HTTPS only.
Bind the metrics listener only to 127.0.0.1:2381.

Do not edit the original fixture or verifier. Do not use kubectl apply; this is a static-manifest file exercise.

Start and prove it

cd /mnt/c/Cloud-Team/04_Learning_and_Reference/Training/CKS
cp lab/lesson-37-etcd-insecure.yaml /tmp/lesson-37-etcd.yaml
nano /tmp/lesson-37-etcd.yaml
bash lab/lesson-37-verify.sh /tmp/lesson-37-etcd.yaml

Completion means every line reports PASS. Send that output only.

Documentation

Use the official etcd transport security guide if needed. The CKS objective is preserving the required configuration while closing only the proven exposure.