0

CoreOS documentation points out that one should use $public_ipv4 instead of $private_ipv4 in setting ectd addr and peer-addr if no private network is available to the cluster. This makes perfect sense, but I'm not clear what the implications of this choice are. Presumably the communication between nodes can still be secured appropriately over a public address? Given that a private address limits one to only adding nodes in the same private network in the future, what advantage does using the private address have? Does this differ in terms of the security of the connection or just performance/speed issues?

1 Answer 1

1

By default, etcd is completely open. Keys can be read/written by anyone.

Security can be improved by firewalling, i.e. only allowing those servers that you define access to your etcd cluster, or in EC2 you can use security groups. This is better, but doesn't stop someone snooping your traffic and reading your configuration.

If you want to hide etcd completely from prying eyes and also provide a level of authentication through client certificates then this is supported, See Transport Security with HTTPS

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .