{"action":"opened","issue":{"url":"https://api.github.com/repos/deis/deis/issues/4326","labels_url":"https://api.github.com/repos/deis/deis/issues/4326/labels{/name}","comments_url":"https://api.github.com/repos/deis/deis/issues/4326/comments","events_url":"https://api.github.com/repos/deis/deis/issues/4326/events","html_url":"https://github.com/deis/deis/issues/4326","id":102870145,"number":4326,"title":"Insecure etcd by default","user":{"login":"Xowap","id":182992,"avatar_url":"https://avatars.githubusercontent.com/u/182992?v=3","gravatar_id":"","url":"https://api.github.com/users/Xowap","html_url":"https://github.com/Xowap","followers_url":"https://api.github.com/users/Xowap/followers","following_url":"https://api.github.com/users/Xowap/following{/other_user}","gists_url":"https://api.github.com/users/Xowap/gists{/gist_id}","starred_url":"https://api.github.com/users/Xowap/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Xowap/subscriptions","organizations_url":"https://api.github.com/users/Xowap/orgs","repos_url":"https://api.github.com/users/Xowap/repos","events_url":"https://api.github.com/users/Xowap/events{/privacy}","received_events_url":"https://api.github.com/users/Xowap/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-08-24T19:14:10Z","updated_at":"2015-08-24T19:14:10Z","closed_at":null,"body":"**Problem**\r\nIf you run Deis in a public cloud (say Digital Ocean), even though you can use the custom firewall script (https://github.com/deis/deis/blob/master/contrib/util/custom-firewall.sh), you still are on the same physical network than all other customers.\r\n\r\nWhich means that if in any way (firewall not up, security issue at the hosting company, ...) a hacker can reach etcd, he can access the whole configuration and even change it, which is basically disastrous.\r\n\r\n**Solution (maybe)**\r\nAccording to the [security model](https://coreos.com/etcd/docs/2.0.8/security.html) document from etcd, you can set up SSL encryption and authentication.\r\n\r\nWhat would be really interesting then would be to set up etcd on HTTPS by default. I believe that with the emergence of services like https://letsencrypt.org/ this can be done in a way that would not affect (too much?) user experience, and even be extended to the app routers, internal traffic between containers, etc."}}