HTTPS not authenticated in many communication channels

[blperez01]

The Kubernetes system allows users to set up a PKI, but in many cases fails to use authenticated TLS between components, which negates any benefit to using a PKI.

For example, the following connections do not use authenticated HTTPS:

• Apiserver -> Kubelet
• Apiserver -> Pods (this doesn't even use HTTPS)
• Apiserver -> etcd

This failure to authenticate components within the system is extremely dangerous and should be changed to use authenticated HTTPS by default. The lack of authentication for etcd alone has led to major vulnerabilities in a wide variety of applications.

[blperez01]

TOA-K8S-034