Does the metrics option support disabling?

[fightingcoding]

After etcd is started, metrics will be enabled by default. During our use of etcd, our security team discovered an unauthorized access vulnerability in metrics, which can obtain sensitive system information. We attempted to disable its exposure by configuring - metrics=none, but it did not take effect. Excuse me, does etcd support disabling the exposure of this indicator?

[vivekpatani]

I don't think etcd metrics supports none as an acceptable option. I think it can only dabble between basic and extensive

That being said, have you tried setting --listen-metrics-urls="" to just empty?

For example: etcd --listen-metrics-urls="" --name=my-etcd --data-dir=/var/lib/etcd, just curious thought, I've never tried it.

[fightingcoding]

Thank you for your idea. Following the corresponding approach, I tried setting the configuration - listen metrics urls to be empty to start etcd. The verification result showed that the metrics content can also be accessed through listen client urls. For example, assuming the current etcd host IP is 192.168.17.10, the listen client urls I set is http://192.168.17.10:2379 , http://127.0.0.1:2379 , it can still be achieved through http://192.168.17.1:2379/metrics or http://127.0.0.1:2379/metrics Accessing the corresponding content of metrics, did not achieve the effect of disabling metrics.