github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-21 19:01:49 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #68982 from aruneli/master

Browse Source 
Fixes #65869 Do not listen insecurely if secure port is specified
This commit is contained in:
k8s-ci-robot 2018-10-03 17:32:28 -07:00 committed by GitHub
commit 5dd78df7da
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cmd/cloud-controller-manager/app/options/options.go
View File

@ -51,6 +51,8 @@ import (
const ( const (
// CloudControllerManagerUserAgent is the userAgent name when starting cloud-controller managers. // CloudControllerManagerUserAgent is the userAgent name when starting cloud-controller managers.
CloudControllerManagerUserAgent = "cloud-controller-manager" CloudControllerManagerUserAgent = "cloud-controller-manager"
// DefaultInsecureCloudControllerManagerPort is the default insecure cloud-controller manager port.
DefaultInsecureCloudControllerManagerPort = 0
) )
// CloudControllerManagerOptions is the main context object for the controller manager. // CloudControllerManagerOptions is the main context object for the controller manager.
@ -74,7 +76,7 @@ type CloudControllerManagerOptions struct {
// NewCloudControllerManagerOptions creates a new ExternalCMServer with a default config. // NewCloudControllerManagerOptions creates a new ExternalCMServer with a default config.
func NewCloudControllerManagerOptions() (*CloudControllerManagerOptions, error) { func NewCloudControllerManagerOptions() (*CloudControllerManagerOptions, error) {
componentConfig, err := NewDefaultComponentConfig(ports.InsecureCloudControllerManagerPort) componentConfig, err := NewDefaultComponentConfig(DefaultInsecureCloudControllerManagerPort)
if err != nil { if err != nil {
return nil, err return nil, err
} }

10
cmd/cloud-controller-manager/app/options/options_test.go
View File

@ -37,8 +37,8 @@ func TestDefaultFlags(t *testing.T) {
expected := &CloudControllerManagerOptions{ expected := &CloudControllerManagerOptions{
Generic: &cmoptions.GenericControllerManagerConfigurationOptions{ Generic: &cmoptions.GenericControllerManagerConfigurationOptions{
Port: 10253, // Note: InsecureServingOptions.ApplyTo will write the flag value back into the component config Port: DefaultInsecureCloudControllerManagerPort, // Note: InsecureServingOptions.ApplyTo will write the flag value back into the component config
Address: "0.0.0.0", // Note: InsecureServingOptions.ApplyTo will write the flag value back into the component config Address: "0.0.0.0", // Note: InsecureServingOptions.ApplyTo will write the flag value back into the component config
MinResyncPeriod: metav1.Duration{Duration: 12 * time.Hour}, MinResyncPeriod: metav1.Duration{Duration: 12 * time.Hour},
ClientConnection: apimachineryconfig.ClientConnectionConfiguration{ ClientConnection: apimachineryconfig.ClientConnectionConfiguration{
ContentType: "application/vnd.kubernetes.protobuf", ContentType: "application/vnd.kubernetes.protobuf",
@ -85,7 +85,7 @@ func TestDefaultFlags(t *testing.T) {
}).WithLoopback(), }).WithLoopback(),
InsecureServing: (&apiserveroptions.DeprecatedInsecureServingOptions{ InsecureServing: (&apiserveroptions.DeprecatedInsecureServingOptions{
BindAddress: net.ParseIP("0.0.0.0"), BindAddress: net.ParseIP("0.0.0.0"),
BindPort: int(10253), BindPort: int(0),
BindNetwork: "tcp", BindNetwork: "tcp",
}).WithLoopback(), }).WithLoopback(),
Authentication: &apiserveroptions.DelegatingAuthenticationOptions{ Authentication: &apiserveroptions.DelegatingAuthenticationOptions{
@ -155,8 +155,8 @@ func TestAddFlags(t *testing.T) {
expected := &CloudControllerManagerOptions{ expected := &CloudControllerManagerOptions{
Generic: &cmoptions.GenericControllerManagerConfigurationOptions{ Generic: &cmoptions.GenericControllerManagerConfigurationOptions{
Port: 10253, // Note: InsecureServingOptions.ApplyTo will write the flag value back into the component config Port: DefaultInsecureCloudControllerManagerPort, // Note: InsecureServingOptions.ApplyTo will write the flag value back into the component config
Address: "0.0.0.0", // Note: InsecureServingOptions.ApplyTo will write the flag value back into the component config Address: "0.0.0.0", // Note: InsecureServingOptions.ApplyTo will write the flag value back into the component config
MinResyncPeriod: metav1.Duration{Duration: 100 * time.Minute}, MinResyncPeriod: metav1.Duration{Duration: 100 * time.Minute},
ClientConnection: apimachineryconfig.ClientConnectionConfiguration{ ClientConnection: apimachineryconfig.ClientConnectionConfiguration{
ContentType: "application/vnd.kubernetes.protobuf", ContentType: "application/vnd.kubernetes.protobuf",

4
test/integration/controllermanager/serving_test.go
View File

@ -213,11 +213,13 @@ func testControllerManager(t *testing.T, tester controllerManagerTester, kubecon
{"no-flags", nil, "/healthz", false, true, nil, nil}, {"no-flags", nil, "/healthz", false, true, nil, nil},
{"insecurely /healthz", []string{ {"insecurely /healthz", []string{
"--secure-port=0", "--secure-port=0",
"--port=10253",
"--kubeconfig", kubeconfig, "--kubeconfig", kubeconfig,
"--leader-elect=false", "--leader-elect=false",
}, "/healthz", true, false, nil, intPtr(http.StatusOK)}, }, "/healthz", true, false, nil, intPtr(http.StatusOK)},
{"insecurely /metrics", []string{ {"insecurely /metrics", []string{
"--secure-port=0", "--secure-port=0",
"--port=10253",
"--kubeconfig", kubeconfig, "--kubeconfig", kubeconfig,
"--leader-elect=false", "--leader-elect=false",
}, "/metrics", true, false, nil, intPtr(http.StatusOK)}, }, "/metrics", true, false, nil, intPtr(http.StatusOK)},
@ -230,6 +232,7 @@ func testControllerManager(t *testing.T, tester controllerManagerTester, kubecon
"--kubeconfig", kubeconfig, "--kubeconfig", kubeconfig,
"--kubeconfig", kubeconfig, "--kubeconfig", kubeconfig,
"--leader-elect=false", "--leader-elect=false",
"--port=10253",
}, "/metrics", true, false, intPtr(http.StatusForbidden), intPtr(http.StatusOK)}, }, "/metrics", true, false, intPtr(http.StatusForbidden), intPtr(http.StatusOK)},
{"authorization skipped for /healthz with authn/authz", []string{ {"authorization skipped for /healthz with authn/authz", []string{
"--port=0", "--port=0",
@ -254,6 +257,7 @@ func testControllerManager(t *testing.T, tester controllerManagerTester, kubecon
"--leader-elect=false", "--leader-elect=false",
}, "/metrics", false, false, intPtr(http.StatusForbidden), nil}, }, "/metrics", false, false, intPtr(http.StatusForbidden), nil},
{"not authorized /metrics with BROKEN authn/authz", []string{ {"not authorized /metrics with BROKEN authn/authz", []string{
"--port=10253",
"--authentication-kubeconfig", kubeconfig, "--authentication-kubeconfig", kubeconfig,
"--authorization-kubeconfig", brokenKubeconfig, "--authorization-kubeconfig", brokenKubeconfig,
"--kubeconfig", kubeconfig, "--kubeconfig", kubeconfig,