Menu
Ensure that the --etcd-cafile argument is set as appropriate (Automated)
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-k8s-v200-1-2-26The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Showing SKILL.md
Based on SOC occupation classification
| name | cis-k8s-v200-1.2.26 |
| description | Ensure that the --etcd-cafile argument is set as appropriate (Automated) |
| category | cis-k8s |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","kubernetes","control-plane","api-server","etcd","tls","certificate-authority"] |
| cis_id | 1.2.26 |
| cis_benchmark | CIS Kubernetes Benchmark v2.0.0 |
| tech_stack | ["kubernetes"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
etcd should be configured to make use of TLS encryption for client connections.
etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be protected by client authentication. This requires the API server to identify itself to the etcd server using a SSL Certificate Authority file.
TLS and client certificate authentication must be configured for etcd.
Run the following command on the Control Plane node:
ps -ef | grep kube-apiserver
Verify that the --etcd-cafile argument exists and it is set as appropriate.
Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd certificate authority file parameter.
--etcd-cafile=<path/to/ca-file>
By default, --etcd-cafile is not set.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.11 Encrypt Sensitive Data at Rest | * | * | |
| v7 | 14.8 Encrypt Sensitive Information at Rest | * |