Etcd: Ability to create users without a password

[crielly]

It would be useful to be able to create a user which does not have a password. Having attempted it via etcdctl, the v2 and v3 APIs, this does not currently seem possible.

Since one of the options for authentication is via Client Certificate CN, a password is not strictly necessary even for the root user. It would be nice if you could:

• create a user via API with an empty string for a password
• create a user via etcdctl with a flag like --nopass so it didn't prompt you for one (useful for scripted setup of a cluster)

[hexfusion]

/cc @mitake

[mitake]

@crielly what is the use case of empty password users? I want to understand your motivation.

[crielly]

@mitake Kubernetes. All auth to the etcd cluster will be done via client certificate, a password is just unnecessary attack surface for this situation. Additionally, it forces you to create users via the v3 API if you want cluster standup to be automated since etcdctl will prompt for password rather than accepting it as a flag (or a --nopass flag).

[mitake]

@crielly I understood your motivation. So the user with no password shouldn't allow password based auth, right? I'll work on it when I can allocate a time (probably this week).

[mitake]

@crielly BTW, just not enabling auth isn't suitable for your use case?

[crielly]

@mitake Yeah, ideally you would be able to create a user without ever supplying a password, which would effectively also disable password authentication for that user

No, no-auth is not an option. Etcd is effectively a backdoor into kubernetes without authorization.

[mitake]

I can start working on this after merging https://github.com/coreos/etcd/pull/9730