Currently, daprd is exposing the public port which exposes the healthz and metadata endpoints. This is exposed publicly on the network. This server has no authentication and is serving requests in plaintext.

The metadata endpoint returns information like actors, subscriptions, components etc.

This represents a massive privacy exposure. This port must be disabled on any multi-tenant deployment of Dapr, however this is not documented anywhere and the daprd logs don't explain that this is happening either. Users are currently exposing this information without knowledge.

We should update this API server to use mTLS based on the dapr identity certificate, and provide an allow list of identities which can connect to this endpoint to authorize it consumption. This is a breaking change, however the current behaviour is not appropriate and should be considered a security vulnerability.