How to set etcd auth for milvus installed by helm

[chjohnhuang123456]

How to ensure the safety of ETCD in production environment

[yhmo]

Follow the doc to configure etcd for milvus: https://milvus.io/docs/deploy_etcd.md#Configure-etcd-on-K8s

In the values.yaml, you can use the "ssl" section to config etcd secure connection mode.

externalEtcd:
  enabled: true
  endpoints: xxxxxxx
  rootPath: by-dev # The root path where data is stored in etcd
  metaSubPath: meta # metaRootPath = rootPath + '/' + metaSubPath
  kvSubPath: kv # kvRootPath = rootPath + '/' + kvSubPath
  log:
    level: info # Only supports debug, info, warn, error, panic, or fatal. Default 'info'.
    # path is one of:
    #  - "default" as os.Stderr,
    #  - "stderr" as os.Stderr,
    #  - "stdout" as os.Stdout,
    #  - file path to append server logs to.
    # please adjust in embedded Milvus: /tmp/milvus/logs/etcd.log
    path: stdout
  ssl:
    enabled: false # Whether to support ETCD secure connection mode
    tlsCert: /path/to/etcd-client.pem # path to your cert file
    tlsKey: /path/to/etcd-client-key.pem # path to your key file
    tlsCACert: /path/to/ca.pem # path to your CACert file
    # TLS min version
    # Optional values: 1.0, 1.1, 1.2, 1.3。
    # We recommend using version 1.2 and above.
    tlsMinVersion: 1.3

[chjohnhuang123456]

Okay, this is the configuration for external ETCD. Do you have a built-in ETCD configuration method for Helm deployment?

[chjohnhuang123456]

I couldn't find any configuration related to the built-in ETCD

[chjohnhuang123456]

I tried to change the following configuration in the value. yaml of ETCD, but after restarting, the microservice couldn't start and kept reporting an error of 500. It seems that communication is not possible after completing the configuration

auth:
  ## Role-based access control parameters
  ## ref: https://etcd.io/docs/current/op-guide/authentication/
  ##
  rbac:
    ## @param auth.rbac.enabled Switch to enable RBAC authentication
    ##
    enabled: true
    ## @param auth.rbac.allowNoneAuthentication Allow to use etcd without configuring RBAC authentication
    ##
    allowNoneAuthentication: false
    ## @param auth.rbac.rootPassword Root user password. The root user is always `root`
    ##
    rootPassword: "Jxlz2020."
    ## @param auth.rbac.existingSecret Name of the existing secret containing credentials for the root user
    ##
    existingSecret: ""
  ## TLS authentication for client-to-server communications
  ## ref: https://etcd.io/docs/current/op-guide/security/

[chjohnhuang123456]

[chjohnhuang123456]

Can you help me check if the microservice connection to etcd fails after enabling auto tls?

[chjohnhuang123456]

auth:
  ## Role-based access control parameters
  ## ref: https://etcd.io/docs/current/op-guide/authentication/
  ##
  rbac:
    ## @param auth.rbac.enabled Switch to enable RBAC authentication
    ##
    enabled: true
    ## @param auth.rbac.allowNoneAuthentication Allow to use etcd without configuring RBAC authentication
    ##
    allowNoneAuthentication: true
    ## @param auth.rbac.rootPassword Root user password. The root user is always `root`
    ##
    rootPassword: "Jxlz2020."
    ## @param auth.rbac.existingSecret Name of the existing secret containing credentials for the root user
    ##
    existingSecret: ""
  ## TLS authentication for client-to-server communications
  ## ref: https://etcd.io/docs/current/op-guide/security/
  ##
  client:
    ## @param auth.client.secureTransport Switch to encrypt client-to-server communications using TLS certificates
    ##
    secureTransport: true
    ## @param auth.client.useAutoTLS Switch to automatically create the TLS certificates
    ##
    useAutoTLS: true
    ## @param auth.client.existingSecret Name of the existing secret containing the TLS certificates for client-to-server communications
    ##
    existingSecret: ""
    ## @param auth.client.enableAuthentication Switch to enable host authentication using TLS certificates. Requires existing secret
    ##
    enableAuthentication: false
    ## @param auth.client.certFilename Name of the file containing the client certificate
    ##
    certFilename: cert.pem
    ## @param auth.client.certKeyFilename Name of the file containing the client certificate private key
    ##
    certKeyFilename: key.pem
    ## @param auth.client.caFilename Name of the file containing the client CA certificate
    ## If not specified and `auth.client.enableAuthentication=true` or `auth.rbac.enabled=true`, the default is is `ca.crt`
    ##
    caFilename: ""
  ## TLS authentication for server-to-server communications
  ## ref: https://etcd.io/docs/current/op-guide/security/
  ##
  peer:
    ## @param auth.peer.secureTransport Switch to encrypt server-to-server communications using TLS certificates
    ##
    secureTransport: true
    ## @param auth.peer.useAutoTLS Switch to automatically create the TLS certificates
    ##
    useAutoTLS: true
    ## @param auth.peer.existingSecret Name of the existing secret containing the TLS certificates for server-to-server communications
    ##
    existingSecret: ""
    ## @param auth.peer.enableAuthentication Switch to enable host authentication using TLS certificates. Requires existing secret
    ##
    enableAuthentication: false
    ## @param auth.peer.certFilename Name of the file containing the peer certificate
    ##
    certFilename: cert.pem
    ## @param auth.peer.certKeyFilename Name of the file containing the peer certificate private key
    ##
    certKeyFilename: key.pem
    ## @param auth.peer.caFilename Name of the file containing the peer CA certificate
    ## If not specified and `auth.peer.enableAuthentication=true` or `rbac.enabled=true`, the default is is `ca.crt`
    ##
    caFilename: ""

This is the auth configuration in the value. yaml section of etcd. Could you please check if there are any issues? Thank you!