If someone was actually interested in security, they would not allow tenant (or user / etc) defined components access the base infrastructure's etcd, even if it

If someone was actually interested in security, they would not allow tenant (or user / etc) defined components access the base infrastructure's etcd, even if it had ACLs. Basic separation of concerns would call for a separate instance of etcd. In a complex environment, spinning up a new etcd should not be a big deal. Now, having ACLs, is not a bad thing, but they should only be used to lock down the base infrastructure access even more, and still have a separate instance for other applications.