[3.4] Backport disable redirects in peer communication

[ivanvc]

Disable following redirects from peer HTTP communication on the client's side. Etcd server may run into SSRF (Server-side request forgery) when adding a new member. If users provide a malicious peer URL, the existing etcd members may be redirected to another unexpected internal URL when getting the new member's version.

Related to #16969

Please read https://github.com/etcd-io/etcd/blob/main/CONTRIBUTING.md#contribution-flow.

[k8s-ci-robot]

Hi @ivanvc. Thanks for your PR.

I'm waiting for a etcd-io member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jmhbnz]

LGTM - Thanks @ivanvc

[ahrtr]

lgtm

Could you add a chanagelog item for 3.4? Thanks

[ivanvc]

lgtm

Could you add a chanagelog item for 3.4? Thanks

Should I do the same for 3.5?

[jmhbnz]

Should I do the same for 3.5?

There is an existing 3.5 changelog 443af24. I do note we only called out the member addition as that was the perceived security risk. Let's add something similar for 3.4, can maybe make the message a bit broader.