Can we Client Certs for ETCD RBAC but without TLS Encryption?

[NBK27]

Can we Client Certs for ETCD RBAC but without TLS Encryption?

We want to use RBAC in ETCD using Client Cert Authentication, but we donot want the traffic to be encrypted for performance reasons. Is this supported in ETCD?

[jmhbnz]

Hi @NBK27 - Thanks for your question. I don't believe this is possible no.

Client certificate authentication without encryption would pose security risks. Without TLS encryption, the data transmitted between the client and etcd would be susceptible to eavesdropping and tampering, making it vulnerable to attacks and making client cert authentication meaningless.

If performance is a significant concern, consider tuning TLS cipher suites and tuning the TLS configuration to achieve a balance between security and performance although I am unsure what gains can be achieved in this area.

If transport layer security is turned off you can revert to using passwords for role based access control.

Refer to:

• https://etcd.io/docs/v3.5/op-guide/security
• https://etcd.io/docs/v3.5/op-guide/authentication/rbac

[NBK27]

Thanks @jmhbnz