github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-09 20:17:41 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #34615 from Calpicow/master

Browse Source 
Automatic merge from submit-queue

Use same SSH tunnel as kubelet

Provides a secure workaround for #11816 by having kube-apiserver use the same SSH tunnel as the kubelet it is trying to connect to. Use in conjunction with iptables or kubelet `--address=127.0.0.1`. The latter will break heapster.

Will fallback to random behavior if the tunnel cannot be found.
This commit is contained in:
Kubernetes Submit Queue 2016-10-15 02:53:08 -07:00 committed by GitHub
commit a38fc047e2
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/ssh/ssh.go
View File

@ -32,6 +32,7 @@ import (
"net/http" "net/http"
"net/url" "net/url"
"os" "os"
"strings"
"sync" "sync"
"time" "time"
@ -391,19 +392,27 @@ func (l *SSHTunnelList) Dial(net, addr string) (net.Conn, error) {
defer func() { defer func() {
glog.Infof("[%x: %v] Dialed in %v.", id, addr, time.Now().Sub(start)) glog.Infof("[%x: %v] Dialed in %v.", id, addr, time.Now().Sub(start))
}() }()
tunnel, err := l.pickRandomTunnel() tunnel, err := l.pickTunnel(strings.Split(addr, ":")[0])
if err != nil { if err != nil {
return nil, err return nil, err
} }
return tunnel.Dial(net, addr) return tunnel.Dial(net, addr)
} }
func (l *SSHTunnelList) pickRandomTunnel() (tunnel, error) { func (l *SSHTunnelList) pickTunnel(addr string) (tunnel, error) {
l.tunnelsLock.Lock() l.tunnelsLock.Lock()
defer l.tunnelsLock.Unlock() defer l.tunnelsLock.Unlock()
if len(l.entries) == 0 { if len(l.entries) == 0 {
return nil, fmt.Errorf("No SSH tunnels currently open. Were the targets able to accept an ssh-key for user %q?", l.user) return nil, fmt.Errorf("No SSH tunnels currently open. Were the targets able to accept an ssh-key for user %q?", l.user)
} }
// Prefer same tunnel as kubelet
// TODO: Change l.entries to a map of address->tunnel
for _, entry := range l.entries {
if entry.Address == addr {
return entry.Tunnel, nil
}
}
glog.Warningf("SSH tunnel not found for address %q, picking random node", addr)
n := mathrand.Intn(len(l.entries)) n := mathrand.Intn(len(l.entries))
return l.entries[n].Tunnel, nil return l.entries[n].Tunnel, nil
} }