Enforce RBAC with etcd Auth Enable and Role Grants

This sequence enables authentication and authorization on etcd using the v3 auth API. Internally, enabling auth switches the gRPC server into authenticated mode: every request must present a valid client certificate or a username/password token, and each operation is checked against role permissions stored in the /auth keyspace. Roles are collections of key-range permissions with read, write, or readwrite access, optionally scoped to prefixes.

Production use cases include multi-tenant clusters where different operators should only manage their own prefixes, isolating Kubernetes from other workloads sharing etcd, and meeting PCI/DSS or SOC2 requirements for least-privilege access to the control plane. The root user is created first and must be preserved; losing root credentials locks you out of the cluster permanently unless you restore from a snapshot.

Security: passwords must be strong and rotated; the root user should be reserved for break-glass and never used by applications. Prefer client certificate auth with CN mapped to a user via --client-cert-auth and RBAC. Performance: auth checks add microseconds per request, negligible at normal load. Pitfalls: enabling auth before creating the root user bricks the cluster (etcd refuses to start); granting root to application roles; forgetting that range_end is exclusive, so prefix /app/ requires range_end /app0 (increment last byte); and not testing RBAC in staging before enforcing in production.

> System.Execute()

export ETCDCTL_API=3
export ETCDCTL_CACERT=/etc/etcd/ca.crt
export ETCDCTL_CERT=/etc/etcd/client.crt
export ETCDCTL_KEY=/etc/etcd/client.key
EP=https://10.0.0.11:2379

# 1. Create root user (REQUIRED before enabling auth)
etcdctl --endpoints=$EP user add root
# (interactive password prompt)

# 2. Create application user and role
etcdctl --endpoints=$EP user add app-svc
etcdctl --endpoints=$EP role add app-role

# range_end is exclusive: /app/ -> /app0
etcdctl --endpoints=$EP role grant-permission app-role readwrite /app/ /app0
etcdctl --endpoints=$EP user grant-role app-svc app-role

# 3. Enable auth (LAST step)
etcdctl --endpoints=$EP auth enable

# 4. Test as app-svc
ETCDCTL_USER=app-svc etcdctl --endpoints=$EP put /app/config '{"k":"v"}'
ETCDCTL_USER=app-svc etcdctl --endpoints=$EP get /app/ --prefix

# 5. Verify root can see everything
etcdctl --endpoints=$EP --user root get / --prefix --keys-only | head

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-F002D5760E62