3 ms·

etcd does contain ACLs: https://coreos.com/etcd/docs/latest/v2/auth_api.html https://coreos.com/etcd/docs/latest/v2/auth_api.html

otterley 10y ago
First, I apologize for my ignorance re: etcd ACL functionality. I did try to research it, but... Can you please ensure it's in the Security section of the documentation? It's not mentioned there at all! https://coreos.com/etcd/docs/latest/op-guide/security.html https://coreos.com/etcd/docs/latest/op-guide/security.html Also, "authentication" is not identical to "authorization" or "access control" -- and it's not obvious to the reader that discussion of one includes the other. The words "ACL" and/or "access control" really need to be specifically used in the title and body of the pertinent documentation to be easily locatable by the researcher. Finally, it doesn't appear that the K8S API server can authenticate to etcd yet. (That's not etcd's fault, but it does contribute to my impression of the integration's overall security posture.) Again, please correct me if I'm mistaken.
- mugsie 10y ago
  The great thing about open source is that you can make changes when you see some thing that is wrong :) https://github.com/coreos/etcd/blob/master/Documentation/v2/auth_api.md https://github.com/coreos/etcd/blob/master/Documentation/v2/... and https://github.com/coreos/etcd/blob/master/Documentation/op-guide/security.md https://github.com/coreos/etcd/blob/master/Documentation/op-... are the two pages.
  - otterley 10y ago
    Open-source doesn't mean free labor. CoreOS is a for-profit enterprise; it's in their own best interest to hire people to produce great documentation.
    - mugsie 10y ago
      Open Source also does not mean free products and support. As a case in point, you were giving out about 2 different pieces of open source software in this thread. Neither of which you have to pay for. Both of which are complex system that have taken many many people hours to build. As a return, is suggesting that you may submit a PR (or even a bug, with suggestions so that the people CoreOS hires to write docs know there is an issue)
- iamskeptic 10y ago
  Maybe you don't realize it but you're coming across as bossy and confrontational: "I (and others) would kindly appreciate it if you'd stop" "If you'd like to find a place to help, I'd suggest" "engineering teams need to do a better job of integrating community PRs " "Finally, I'd like to see deadlines and decision-makers appointed" "What facts do you think I don't possess?"
  - otterley 10y ago
    I have no doubt. After spending 1 year with K8S, I've become extremely frustrated with it and its components. I honestly expected more (and better) out of Google and its partners and contributors. They don't owe me anything in particular, but I do wish more people would let their fruit ripen on the vine instead of in the grocery store (or worse, at the purchaser's house). And judging by the comment scores, I'm not the only one who feels this way. Conversely, you may note that I do get very excited and happy about products that are well-designed, well-documented, and aren't dumped onto an unsuspecting public before they are mature.
    - iamskeptic 10y ago
      Immature software is sure a stressing place thing to get involved with. Thanks for explaining your point of view. I think this article is pertinent: https://medium.com/@thejameskyle/dear-javascript-7e14ffcae36c https://medium.com/@thejameskyle/dear-javascript-7e14ffcae36...
      - otterley 10y ago
        Thanks. I've no doubt that the teams involved are well intentioned, and I don't want to discourage them from doing quality work. And I know it can be frustrating to receive negative feedback. So if anyone's feelings have been hurt, please know that was not my intent.

otterley 10y ago

First, I apologize for my ignorance re: etcd ACL functionality. I did try to research it, but... Can you please ensure it's in the Security section of the documentation? It's not mentioned there at all! https://coreos.com/etcd/docs/latest/op-guide/security.html https://coreos.com/etcd/docs/latest/op-guide/security.html Also, "authentication" is not identical to "authorization" or "access control" -- and it's not obvious to the reader that discussion of one includes the other. The words "ACL" and/or "access control" really need to be specifically used in the title and body of the pertinent documentation to be easily locatable by the researcher. Finally, it doesn't appear that the K8S API server can authenticate to etcd yet. (That's not etcd's fault, but it does contribute to my impression of the integration's overall security posture.) Again, please correct me if I'm mistaken.

mugsie 10y ago
The great thing about open source is that you can make changes when you see some thing that is wrong :) https://github.com/coreos/etcd/blob/master/Documentation/v2/auth_api.md https://github.com/coreos/etcd/blob/master/Documentation/v2/... and https://github.com/coreos/etcd/blob/master/Documentation/op-guide/security.md https://github.com/coreos/etcd/blob/master/Documentation/op-... are the two pages.
- otterley 10y ago
  Open-source doesn't mean free labor. CoreOS is a for-profit enterprise; it's in their own best interest to hire people to produce great documentation.
  - mugsie 10y ago
    Open Source also does not mean free products and support. As a case in point, you were giving out about 2 different pieces of open source software in this thread. Neither of which you have to pay for. Both of which are complex system that have taken many many people hours to build. As a return, is suggesting that you may submit a PR (or even a bug, with suggestions so that the people CoreOS hires to write docs know there is an issue)
iamskeptic 10y ago
Maybe you don't realize it but you're coming across as bossy and confrontational: "I (and others) would kindly appreciate it if you'd stop" "If you'd like to find a place to help, I'd suggest" "engineering teams need to do a better job of integrating community PRs " "Finally, I'd like to see deadlines and decision-makers appointed" "What facts do you think I don't possess?"
- otterley 10y ago
  I have no doubt. After spending 1 year with K8S, I've become extremely frustrated with it and its components. I honestly expected more (and better) out of Google and its partners and contributors. They don't owe me anything in particular, but I do wish more people would let their fruit ripen on the vine instead of in the grocery store (or worse, at the purchaser's house). And judging by the comment scores, I'm not the only one who feels this way. Conversely, you may note that I do get very excited and happy about products that are well-designed, well-documented, and aren't dumped onto an unsuspecting public before they are mature.
  - iamskeptic 10y ago
    Immature software is sure a stressing place thing to get involved with. Thanks for explaining your point of view. I think this article is pertinent: https://medium.com/@thejameskyle/dear-javascript-7e14ffcae36c https://medium.com/@thejameskyle/dear-javascript-7e14ffcae36...
    - otterley 10y ago
      Thanks. I've no doubt that the teams involved are well intentioned, and I don't want to discourage them from doing quality work. And I know it can be frustrating to receive negative feedback. So if anyone's feelings have been hurt, please know that was not my intent.