moonming opened a new issue, #1032: URL: https://github.com/apache/apisix-helm-chart/issues/1032
## Summary With default values, the `apisix` chart deploys the bundled etcd without authentication, and the etcd NetworkPolicy accepts connections on port 2379 from any source. APISIX loads its configuration from that etcd. Any workload that can reach the etcd Service can therefore change routes, upstreams and plugins directly, without going through the Admin API, its key, or `allow_admin`. Line references are to chart master [`60efe58`](https://github.com/apache/apisix-helm-chart/tree/60efe5831a95e39b539d9ba2b6fdd2342e4c1bf4) (chart 2.18.2, APISIX 3.19.0) and the bundled etcd chart 12.0.18. ## Current behavior - `etcd.enabled: true` and `etcd.auth.rbac.create: false` are the defaults ([values.yaml#L865-L893](https://github.com/apache/apisix-helm-chart/blob/60efe5831a95e39b539d9ba2b6fdd2342e4c1bf4/charts/apisix/values.yaml#L865-L893)). - With default values, `helm template t charts/apisix` (Helm 4.2.4) renders the etcd StatefulSet with `ALLOW_NONE_AUTHENTICATION=yes` and no root password, and an APISIX config with no etcd `user` or `password`. - The NetworkPolicy rendered by the bundled etcd chart allows ingress to 2379 and 2380 with no `from` restriction, because `networkPolicy.allowExternal` defaults to `true` in etcd 12.0.18: ```yaml ingress: # Allow inbound connections - ports: - port: 2379 - port: 2380 ``` A separate change is making the Admin API key random by default. That change alone does not close this path for the default etcd deployment. ## What already exists The chart already wires etcd credentials when RBAC is enabled. With `etcd.auth.rbac.create: true`, the bundled etcd chart generates a root password into the `<release>-etcd` Secret, and the apisix chart injects it as `APISIX_ETCD_PASSWORD` ([deployment.yaml#L102-L108](https://github.com/apache/apisix-helm-chart/blob/60efe5831a95e39b539d9ba2b6fdd2342e4c1bf4/charts/apisix/templates/deployment.yaml#L102-L108), [configmap.yaml#L437-L439](https://github.com/apache/apisix-helm-chart/blob/60efe5831a95e39b539d9ba2b6fdd2342e4c1bf4/charts/apisix/templates/configmap.yaml#L437-L439)). Enabling authentication is therefore mostly a change of defaults. ## Suggested direction - Enable etcd RBAC by default in the next major chart version. - Restrict the etcd NetworkPolicy to APISIX pods (for example `networkPolicy.allowExternal: false` plus the client label on the APISIX pods), with a value for users who need other clients. - Verify and document how existing releases upgrade: how the bundled etcd chart turns on authentication for a cluster that already has data, and what APISIX needs during the rollout. I have not tested this yet. - The generated root password relies on `lookup`, which returns nothing under `helm template` (for example Argo CD). GitOps users should provide `etcd.auth.rbac.existingSecret`. ## Questions 1. Is enabling RBAC by default acceptable for the next major version? 2. Should the NetworkPolicy allow only APISIX pods by default? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
