[Bug]: Restrict access to '/api/v1' RESTful API

[ghu613]

Is there an existing issue for this?

• I have searched the existing issues

Environment

- Milvus version: v2.4.5
- Deployment mode(standalone or cluster): cluster
- MQ type(rocksmq, pulsar or kafka): kafka   
- SDK version(e.g. pymilvus v2.0.0rc2): v2.4.3
- OS(Ubuntu or CentOS): RockyLinux
- CPU/Memory: 
- GPU: none
- Others:

Current Behavior

A user not granted with DropCollection permission can drop collections via '/api/v1/collection' RESTful API.

Expected Behavior

Enable role based access control to '/api/v1' routes or merge their functionalities with v2 API and then deprecate '/api/v1'

Steps To Reproduce

No response

Milvus Log

No response

Anything else?

No response

[zhuwenxing]

Is it the interface in this link: https://milvus.io/api-reference/restful/v2.4.x/v1/Collection%20(v1)/Drop.md? or something else?

[ghu613]

It was probably created before v1 and v2 API and don't think it's documented.
Reference:
https://github.com/milvus-io/milvus/blob/master/internal/distributed/proxy/httpserver/handler.go#L26

[zhuwenxing]

It was probably created before v1 and v2 API and don't think it's documented. Reference: https://github.com/milvus-io/milvus/blob/master/internal/distributed/proxy/httpserver/handler.go#L26

This API was implemented a long time ago by @haorenfsa , but it hasn't been integrated with the authentication system. Should we consider abandoning it?
@czs007 What do you think?

[haorenfsa]

/api/v1 should be deprecated.
@ghu613 You can find the docs in v2.1.x doc https://milvus.io/docs/v2.1.x/create_collection.md, switch to the Curl tab

[haorenfsa]

By the way 9091 is considered an admin api port and should not be exposed to non admin users.

[ghu613]

If it's not too much trouble, please add the health endpoint in v2/v1. Thanks.

[yanliang567]

/assign @smellthemoon
/unassign