etcd icon indicating copy to clipboard operation
etcd copied to clipboard

etcdctl: add etcdctl snapshot pipe command

Open Ais8Ooz8 opened this issue 1 year ago • 15 comments

To improve the security of etcdctl. Added the ability to write snapshots to stdout without writing data to disk. Useful for read-only file systems.

Solves https://github.com/etcd-io/etcd/issues/16242

Ais8Ooz8 avatar Jul 14 '23 22:07 Ais8Ooz8

This issue has been automatically marked as stale because it has not had recent activity. It will be closed after 21 days if no further activity occurs. Thank you for your contributions.

stale[bot] avatar Oct 15 '23 14:10 stale[bot]

This way, we could reuse most of the logic while providing flexibility in saving the snapshot to different destinations, such as an actual file or os.Stdout.

I agree with James. Much of the logic can be refactored by passing a file writer into SaveWithVersion.

@Ais8Ooz8 can you followup on this? Thanks!

siyuanfoundation avatar Mar 15 '24 16:03 siyuanfoundation

/ok-to-test

jmhbnz avatar Mar 18 '24 14:03 jmhbnz

/ok-to-test

siyuanfoundation avatar Mar 19 '24 11:03 siyuanfoundation

@Ais8Ooz8 can you fix the fmt error? It is a nitty one about an empty line. Thanks!

siyuanfoundation avatar Mar 22 '24 08:03 siyuanfoundation

/retest

Ais8Ooz8 avatar Mar 22 '24 19:03 Ais8Ooz8

/lgtm

siyuanfoundation avatar Mar 23 '24 00:03 siyuanfoundation

Discussed during sig-etcd triage - this is looking good, @ahrtr could you please take a look for final review?

jmhbnz avatar Mar 28 '24 18:03 jmhbnz

Is there a real use case for the etcdctl snapshot pipe command? @Ais8Ooz8

ahrtr avatar Mar 28 '24 19:03 ahrtr

QQ, isn't the UNIX convention to use - as a file name to mean writing to pipe? At least tar does it. So that would be etcdctl snapshot safe -.

High level, I don't think we need a separate command, it can be just a flag.

serathius avatar Mar 29 '24 09:03 serathius

/retest

Ais8Ooz8 avatar Mar 29 '24 12:03 Ais8Ooz8

@ahrtr Since most encryption and compression utilities work with standard streams, and s3 utilities have subcommands such as aws s3 cp - or mc pipe, it seems like a real use case because it can be used in a single pipeline.

@serathius I think tar uses - along as --files-from=- for stdin and --to-stdout for stdout. In general, I agree that we can use a flag instead of a subcommand. Let's discuss which solution would be the most elegant.

Ais8Ooz8 avatar Mar 29 '24 14:03 Ais8Ooz8

/retest

Ais8Ooz8 avatar Mar 30 '24 08:03 Ais8Ooz8

Since @serathius has a comment on adding a flag instead of a new command, so leave to @serathius to take a second look.

Either a flag or a new command works for me. A new command is slight clearer, but not a big deal in this case.

ahrtr avatar May 03 '24 06:05 ahrtr