main · last commit
1 month ago ·
2npkec0r
tarantool-etcd-zl3 Maintenance RPCs not root-gated — and docs/TODO.md justifies it with a false claim about etcd 3.6
Lined Up
bd update tarantool-etcd-zl3 --claim
bd close tarantool-etcd-zl3
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-07-17T13:20:14Z |
| Updated | 2026-07-17T13:20:14Z |
TWO problems; the doc one is confirmed and independently verified, the code one is a real decision to make.
1) DOC BUG (verified by hand at the v3.6.0 tag). docs/TODO.md:130-132 states: 'Maintenance RPCs are not RBAC-gated — matches etcd 3.6, which doesn't permission-check Status/Hash/HashKV/Defragment/Alarm/MoveLeader.' That is factually wrong for 5 of the 6. At v3.6.0, NewMaintenanceServer returns &authMaintenanceServer{srv, &AuthAdmin{s}} — always wrapped — and Defragment/Snapshot/Hash/HashKV/Status/MoveLeader/Downgrade each call ams.isPermitted(ctx). Only Alarm is genuinely ungated, matching us. A deliberate divergence resting on a false premise is not a deliberate divergence; fix the entry regardless of what we decide to implement.
2) CODE GAP. Zero require_admin/require_permission in app/etcd/maintenance.lua and cluster.lua; auth.begin_grpc_request passes anonymous through (auth.lua:356-358). So any unauthenticated client can call Status/Hash/HashKV/Defragment/MoveLeader with auth enabled.
Scope correction from the sweep's refuter: Cluster.MemberList non-gating DOES match v3.6.0; the requireAuthInfo relaxations are 3.7-dev only. Real scope is the 5 maintenance RPCs (Snapshot/Downgrade are unimplemented here anyway).
docs/TODO.md:130-132 corrected to state what etcd 3.6.0 actually does; the 5 RPCs root-gated (or a corrected, true rationale recorded for keeping them open); Alarm stays ungated.
No outgoing dependencies.
Nothing depends on this issue.
| id | tarantool-etcd-zl3 |
| content_hash | a8b07f282a651d33df22d0c4f016408f1864fdcea3d059bb2d8b617e9585f9d3 |
| title | Maintenance RPCs not root-gated — and docs/TODO.md justifies it with a false claim about etcd 3.6 |
| description | TWO problems; the doc one is confirmed and independently verified, the code one is a real decision to make. 1) DOC BUG (verified by hand at the v3.6.0 tag). docs/TODO.md:130-132 states: 'Maintenance RPCs are not RBAC-gated — matches etcd 3.6, which doesn't permission-check Status/Hash/HashKV/Defragment/Alarm/MoveLeader.' That is factually wrong for 5 of the 6. At v3.6.0, NewMaintenanceServer returns &authMaintenanceServer{srv, &AuthAdmin{s}} — always wrapped — and Defragment/Snapshot/Hash/HashKV/Status/MoveLeader/Downgrade each call ams.isPermitted(ctx). Only Alarm is genuinely ungated, matching us. A deliberate divergence resting on a false premise is not a deliberate divergence; fix the entry regardless of what we decide to implement. 2) CODE GAP. Zero require_admin/require_permission in app/etcd/maintenance.lua and cluster.lua; auth.begin_grpc_request passes anonymous through (auth.lua:356-358). So any unauthenticated client can call Status/Hash/HashKV/Defragment/MoveLeader with auth enabled. Scope correction from the sweep's refuter: Cluster.MemberList non-gating DOES match v3.6.0; the requireAuthInfo relaxations are 3.7-dev only. Real scope is the 5 maintenance RPCs (Snapshot/Downgrade are unimplemented here anyway). |
| design | |
| acceptance_criteria | docs/TODO.md:130-132 corrected to state what etcd 3.6.0 actually does; the 5 RPCs root-gated (or a corrected, true rationale recorded for keeping them open); Alarm stays ungated. |
| notes | |
| status | open |
| priority | 2 |
| issue_type | bug |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-07-17T13:20:14Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-07-17T13:20:14Z |
| closed_at | NULL |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | <binary> |
| source_repo | |
| close_reason | |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | NULL |
| is_blocked | 0 |
| issue_id | tarantool-etcd-zl3 |
| label | etcd-changelog-sweep |
| id | 019f703c-1661-7714-8609-8ccb0ff6a6ba |
| issue_id | tarantool-etcd-zl3 |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-07-17T16:20:13Z |
| id | 019f703c-1662-7167-be37-9e20002e7b99 |
| issue_id | tarantool-etcd-zl3 |
| event_type | label_added |
| actor | Eugene Blikh |
| old_value | NULL |
| new_value | NULL |
| comment | Added label: etcd-changelog-sweep |
| created_at | 2026-07-17T16:20:13Z |
No comments.