m3

m3 copied to clipboard

Right now, the documentation doesn't explain how to secure communication between M3DB and etcd and also between M3DB nodes. There are no TLS options in the example configuration files.

Looking at the source code, TLS seems to be supported, at least for the etcdclusters and seednodes configurations. These two components use a different configuration format, however, and it's not entirely clear what the etcdclusters TLSConfig does. The code comments are meaningless, and the documentation lacks a description of the options.

SeedNodeSecurityConfig is better, in that it has separate options for client and server certificates for the embedded etcd cluster. But there is no documentation either, and the comments are equally meaningless.

As for communication between M3 nodes, is there even some sort of security? I don't see any place where TLS certificates or some other kind of authentication and transport security could be configured.

@schallert Can comment here on TLSConfig for etcd and seed nodes, but in general, communication between M3DB nodes are not secured. The system was designed to be run inside a secure network. You can secure writes into the overall system, but between the components of the system, there are no security mechanisms now.

@gibbscullen Can you explain why this was closed? Was the documentation updated?

Yes, we are actively working on updating the M3 documentation.

@schallert -- following up on this ... can you comment here on TLSConfig for etcd and seed nodes when have a chance?