github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-09-13 21:25:09 +00:00
Code Issues Projects Releases Wiki Activity

bump RemoteRequestHeaderUID featuregate to Beta, on by default

Browse Source
This commit is contained in:
Stanislav Láznička
2025-02-05 15:32:57 +01:00
parent af3b4cd57a
commit b3890d9fa0
4 changed files with 72 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/features/versioned_kube_features.go
View File

@@ -293,6 +293,7 @@ var defaultVersionedKubernetesFeatureGates = map[featuregate.Feature]featuregate
genericfeatures.RemoteRequestHeaderUID: {
{Version: version.MustParse("1.32"), Default: false, PreRelease: featuregate.Alpha},
{Version: version.MustParse("1.33"), Default: true, PreRelease: featuregate.Beta},
},
genericfeatures.ResilientWatchCacheInitialization: {

1
staging/src/k8s.io/apiserver/pkg/features/kube_features.go
View File

@@ -331,6 +331,7 @@ var defaultVersionedKubernetesFeatureGates = map[featuregate.Feature]featuregate
RemoteRequestHeaderUID: {
{Version: version.MustParse("1.32"), Default: false, PreRelease: featuregate.Alpha},
{Version: version.MustParse("1.33"), Default: true, PreRelease: featuregate.Beta},
},
ResilientWatchCacheInitialization: {

93
staging/src/k8s.io/kube-aggregator/pkg/apiserver/handler_proxy_test.go
View File

@@ -57,7 +57,6 @@ import (
utilflowcontrol "k8s.io/apiserver/pkg/util/flowcontrol"
apiserverproxyutil "k8s.io/apiserver/pkg/util/proxy"
"k8s.io/client-go/transport"
"k8s.io/component-base/featuregate"
featuregatetesting "k8s.io/component-base/featuregate/testing"
"k8s.io/component-base/metrics"
"k8s.io/component-base/metrics/legacyregistry"
@@ -134,10 +133,11 @@ func TestProxyHandler(t *testing.T) {
expectedCalled bool
expectedHeaders map[string][]string
enableFeatureGates []featuregate.Feature
remoteRequestHeaderUIDFeature bool
}{
"no target": {
expectedStatusCode: http.StatusNotFound,
remoteRequestHeaderUIDFeature: true,
},
"no user": {
apiService: &apiregistration.APIService{
@@ -155,6 +155,41 @@ func TestProxyHandler(t *testing.T) {
},
expectedStatusCode: http.StatusInternalServerError,
expectedBody: "missing user",
remoteRequestHeaderUIDFeature: true,
},
"[-RemoteRequestHeaderUID] proxy with user, insecure": {
user: &user.DefaultInfo{
Name: "username",
UID: "6b60d791-1af9-4513-92e5-e4252a1e0a78",
Groups: []string{"one", "two"},
},
path: "/request/path",
apiService: &apiregistration.APIService{
ObjectMeta: metav1.ObjectMeta{Name: "v1.foo"},
Spec: apiregistration.APIServiceSpec{
Service: &apiregistration.ServiceReference{Port: ptr.To[int32](443)},
Group: "foo",
Version: "v1",
InsecureSkipTLSVerify: true,
},
Status: apiregistration.APIServiceStatus{
Conditions: []apiregistration.APIServiceCondition{
{Type: apiregistration.Available, Status: apiregistration.ConditionTrue},
},
},
},
remoteRequestHeaderUIDFeature: false,
expectedStatusCode: http.StatusOK,
expectedCalled: true,
expectedHeaders: map[string][]string{
"X-Forwarded-Proto": {"https"},
"X-Forwarded-Uri": {"/request/path"},
"X-Forwarded-For": {"127.0.0.1"},
"X-Remote-User": {"username"},
"User-Agent": {"Go-http-client/1.1"},
"Accept-Encoding": {"gzip"},
"X-Remote-Group": {"one", "two"},
},
},
"proxy with user, insecure": {
user: &user.DefaultInfo{
@@ -177,6 +212,7 @@ func TestProxyHandler(t *testing.T) {
},
},
},
remoteRequestHeaderUIDFeature: true,
expectedStatusCode: http.StatusOK,
expectedCalled: true,
expectedHeaders: map[string][]string{
@@ -184,12 +220,13 @@ func TestProxyHandler(t *testing.T) {
"X-Forwarded-Uri": {"/request/path"},
"X-Forwarded-For": {"127.0.0.1"},
"X-Remote-User": {"username"},
"X-Remote-Uid": {"6b60d791-1af9-4513-92e5-e4252a1e0a78"},
"User-Agent": {"Go-http-client/1.1"},
"Accept-Encoding": {"gzip"},
"X-Remote-Group": {"one", "two"},
},
},
"[RemoteRequestHeaderUID] proxy with user, insecure": {
"[-RemoteRequestHeaderUID] proxy with user, cabundle": {
user: &user.DefaultInfo{
Name: "username",
UID: "6b60d791-1af9-4513-92e5-e4252a1e0a78",
@@ -199,10 +236,10 @@ func TestProxyHandler(t *testing.T) {
apiService: &apiregistration.APIService{
ObjectMeta: metav1.ObjectMeta{Name: "v1.foo"},
Spec: apiregistration.APIServiceSpec{
Service: &apiregistration.ServiceReference{Port: ptr.To[int32](443)},
Service: &apiregistration.ServiceReference{Name: "test-service", Namespace: "test-ns", Port: ptr.To[int32](443)},
Group: "foo",
Version: "v1",
InsecureSkipTLSVerify: true,
CABundle: testCACrt,
},
Status: apiregistration.APIServiceStatus{
Conditions: []apiregistration.APIServiceCondition{
@@ -210,7 +247,7 @@ func TestProxyHandler(t *testing.T) {
},
},
},
enableFeatureGates: []featuregate.Feature{features.RemoteRequestHeaderUID},
remoteRequestHeaderUIDFeature: false,
expectedStatusCode: http.StatusOK,
expectedCalled: true,
expectedHeaders: map[string][]string{
@@ -218,7 +255,6 @@ func TestProxyHandler(t *testing.T) {
"X-Forwarded-Uri": {"/request/path"},
"X-Forwarded-For": {"127.0.0.1"},
"X-Remote-User": {"username"},
"X-Remote-Uid": {"6b60d791-1af9-4513-92e5-e4252a1e0a78"},
"User-Agent": {"Go-http-client/1.1"},
"Accept-Encoding": {"gzip"},
"X-Remote-Group": {"one", "two"},
@@ -245,40 +281,7 @@ func TestProxyHandler(t *testing.T) {
},
},
},
expectedStatusCode: http.StatusOK,
expectedCalled: true,
expectedHeaders: map[string][]string{
"X-Forwarded-Proto": {"https"},
"X-Forwarded-Uri": {"/request/path"},
"X-Forwarded-For": {"127.0.0.1"},
"X-Remote-User": {"username"},
"User-Agent": {"Go-http-client/1.1"},
"Accept-Encoding": {"gzip"},
"X-Remote-Group": {"one", "two"},
},
},
"[RemoteRequestHeaderUID] proxy with user, cabundle": {
user: &user.DefaultInfo{
Name: "username",
UID: "6b60d791-1af9-4513-92e5-e4252a1e0a78",
Groups: []string{"one", "two"},
},
path: "/request/path",
apiService: &apiregistration.APIService{
ObjectMeta: metav1.ObjectMeta{Name: "v1.foo"},
Spec: apiregistration.APIServiceSpec{
Service: &apiregistration.ServiceReference{Name: "test-service", Namespace: "test-ns", Port: ptr.To[int32](443)},
Group: "foo",
Version: "v1",
CABundle: testCACrt,
},
Status: apiregistration.APIServiceStatus{
Conditions: []apiregistration.APIServiceCondition{
{Type: apiregistration.Available, Status: apiregistration.ConditionTrue},
},
},
},
enableFeatureGates: []featuregate.Feature{features.RemoteRequestHeaderUID},
remoteRequestHeaderUIDFeature: true,
expectedStatusCode: http.StatusOK,
expectedCalled: true,
expectedHeaders: map[string][]string{
@@ -313,6 +316,7 @@ func TestProxyHandler(t *testing.T) {
},
},
},
remoteRequestHeaderUIDFeature: true,
expectedStatusCode: http.StatusServiceUnavailable,
},
"service unresolveable": {
@@ -337,6 +341,7 @@ func TestProxyHandler(t *testing.T) {
},
},
},
remoteRequestHeaderUIDFeature: true,
expectedStatusCode: http.StatusServiceUnavailable,
},
"fail on bad serving cert": {
@@ -359,6 +364,7 @@ func TestProxyHandler(t *testing.T) {
},
},
},
remoteRequestHeaderUIDFeature: true,
expectedStatusCode: http.StatusServiceUnavailable,
},
"fail on bad serving cert w/o SAN and increase SAN error counter metrics": {
@@ -384,6 +390,7 @@ func TestProxyHandler(t *testing.T) {
},
serviceCertOverride: svcCrtNoSAN,
increaseSANWarnCounter: true,
remoteRequestHeaderUIDFeature: true,
expectedStatusCode: http.StatusServiceUnavailable,
},
}
@@ -394,9 +401,7 @@ func TestProxyHandler(t *testing.T) {
legacyregistry.Reset()
t.Run(name, func(t *testing.T) {
for _, f := range tc.enableFeatureGates {
featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, f, true)
}
featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.RemoteRequestHeaderUID, tc.remoteRequestHeaderUIDFeature)
targetServer := httptest.NewUnstartedServer(target)
serviceCert := tc.serviceCertOverride

4
test/compatibility_lifecycle/reference/versioned_feature_list.yaml
View File

@@ -1101,6 +1101,10 @@
lockToDefault: false
preRelease: Alpha
version: "1.32"
- default: true
lockToDefault: false
preRelease: Beta
version: "1.33"
- name: ResilientWatchCacheInitialization
versionedSpecs:
- default: true