Restrict etcd Access: TLS, RBAC, and Firewall Methods

• A.Use firewall rules to restrict access to etcd port 2379
• ✓ B.Use TLS client certificates for authentication
• ✓ C.Enable etcd RBAC
• D.Use etcd's built-in password authentication
• E.Set the --etcd-certfile flag on kube-apiserver

Why B: Option B is correct because etcd supports mutual TLS (mTLS) authentication, where the client (e.g., kube-apiserver) presents a client certificate signed by the etcd CA. This ensures that only authenticated clients can communicate with etcd, effectively restricting access. Option C is correct because etcd has its own Role-Based Access Control (RBAC) system, which can be enabled to restrict read/write operations to specific users or roles, providing fine-grained access control.

• ✓ A.Configure etcd with TLS client certificates and require authentication
• B.Set the etcd flag --peer-auto-tls=true
• C.Configure etcd to use RBAC with a role that allows only the API server
• D.Use a firewall rule to restrict access to etcd's port from the API server's IP

Why A: Option A is correct because etcd supports mutual TLS (mTLS) authentication, which requires clients to present a valid TLS certificate signed by a trusted CA. By configuring etcd with `--client-cert-auth=true` and providing the API server's client certificate, you ensure that only the API server (or any client with a valid certificate) can communicate with etcd. This is the recommended Kubernetes approach to restrict access to etcd, as it cryptographically verifies the identity of the client.

• ✓ A.Use TLS certificates for client and server authentication
• ✓ B.Enable RBAC authorization in etcd
• C.Use simple username and password authentication
• D.Put etcd on the same network as the API server without firewall
• E.Encrypt etcd data at rest

Why A: Restricting access to etcd means controlling which clients can connect and what operations they can perform. Option A is correct because mutual TLS (mTLS) authentication ensures that only clients with a valid certificate (like kube-apiserver) can establish a connection to etcd. Option B is correct because etcd supports RBAC authorization, which limits the operations that an authenticated client can perform on etcd keys. Option C is incorrect because etcd does not support simple username/password authentication. Option D is incorrect because placing etcd on the same network without a firewall does not restrict access; it may even increase risk. Option E is incorrect because encrypting data at rest protects confidentiality but does not restrict who can read or write to etcd; it is a separate security control. Note: Although the stem asks to 'Select THREE', only two of the given options are valid methods to restrict access to etcd. The third correct method (e.g., network policies or firewall rules) is not listed among the choices.

• ✓ A.Enable RBAC on etcd by setting --auth-token=jwt and configuring roles.
• B.Use --peer-auto-tls=true to auto-generate certificates.
• C.Use --admission-control=NodeRestriction on etcd.
• ✓ D.Use TLS client certificates for authentication.
• E.Set --client-cert-auth=false to disable authentication.

Why A: Option A is correct because etcd supports Role-Based Access Control (RBAC) when you enable it with the `--auth-token=jwt` flag and then configure roles and users via `etcdctl`. This allows you to restrict which clients can read or write to the etcd key-value store, which is critical for securing Kubernetes cluster state. Without RBAC, any client that can reach the etcd port can access all secrets and configuration data.

• ✓ A.Enable etcd RBAC to restrict read/write access
• B.Use HTTP instead of HTTPS
• C.Disable client authentication for simplicity
• ✓ D.Use firewall rules to restrict network access to etcd
• ✓ E.Use TLS client certificates for authentication

Why A: Option A is correct because etcd supports Role-Based Access Control (RBAC) that allows you to define roles and permissions to restrict read and write access to keys. By enabling etcd RBAC, you can enforce fine-grained authorization, ensuring that only authenticated and authorized clients (e.g., the Kubernetes API server) can perform specific operations on etcd data.