<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# etcd Security — API Reference

## etcdctl CLI

```bash
ETCDCTL_API=3 etcdctl endpoint health \
  --endpoints=https://127.0.0.1:2379 --cacert=CA --cert=CERT --key=KEY
ETCDCTL_API=3 etcdctl snapshot save FILE --endpoints=EP --cacert=CA --cert=CERT --key=KEY
ETCDCTL_API=3 etcdctl member list --endpoints=EP --cacert=CA --cert=CERT --key=KEY
ETCDCTL_API=3 etcdctl get /registry/secrets/NS/NAME --endpoints=EP --cacert=CA --cert=CERT --key=KEY
```

## Encryption Providers

| Provider | Description |
|----------|-------------|
| `aescbc` | AES-CBC with PKCS#7 padding |
| `aesgcm` | AES-GCM authenticated encryption |
| `secretbox` | XSalsa20-Poly1305 |
| `identity` | No encryption (plaintext) |
| `kms` | External KMS provider |

## etcd Security Flags

| Flag | Description |
|------|-------------|
| `--cert-file` | Server TLS certificate |
| `--key-file` | Server TLS private key |
| `--client-cert-auth` | Require client certificates |
| `--peer-cert-file` | Peer TLS certificate |
| `--peer-key-file` | Peer TLS private key |
