API Security Defects, All access should be authorized, includes monitoring and internal communication

[alex-quan-001]

Bug Report

1. Minimal reproduce step (Required)

curl http://hostip:2379/pd/api/v1/regions

2. What did you expect to see? (Required)

Only authorized to access data, use password or other encryption methods
All access should be authorized, includes monitoring and internal communication

3. What did you see instead (Required)

Return data directly

4. What is your TiDB version? (Required)

Release Version: v5.0.0-rc
Edition: Community
Git Commit Hash: fd4437d
Git Branch: heads/refs/tags/v5.0.0-rc
UTC Build Time: 2021-01-12 06:00:03
GoVersion: go1.13
Race Enabled: false
TiKV Min Version: v3.0.0-60965b006877ca7234adaced7890d7b029ed1306
Check Table Before Drop: false

[zz-jason]

@bb7133 could you take a look?

[nolouch]

I think it's a feature, ref tikv/rfcs#62