mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-09-17 23:19:26 +00:00
Pod proxy, exec and portforward subresources
Makes it possible to access the following subresources: /namespaces/<ns>/pods/<pod-name>[:port]/proxy /namespaces/<ns>/pods/<pod-name>/exec?container=<container>&command=<cmd> /namespaces/<ns>/pods/<pod-name>/portforward
This commit is contained in:
Cesar Wong
197
pkg/registry/generic/rest/proxy.go
Normal file
197
pkg/registry/generic/rest/proxy.go
Normal file
@@ -0,0 +1,197 @@
|
||||
/*
|
||||
Copyright 2014 Google Inc. All rights reserved.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package rest
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"fmt"
|
||||
"io"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/http/httputil"
|
||||
"net/url"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/GoogleCloudPlatform/kubernetes/pkg/api/errors"
|
||||
"github.com/GoogleCloudPlatform/kubernetes/pkg/util/httpstream"
|
||||
"github.com/GoogleCloudPlatform/kubernetes/pkg/util/proxy"
|
||||
|
||||
"github.com/GoogleCloudPlatform/kubernetes/third_party/golang/netutil"
|
||||
"github.com/golang/glog"
|
||||
)
|
||||
|
||||
// UpgradeAwareProxyHandler is a handler for proxy requests that may require an upgrade
|
||||
type UpgradeAwareProxyHandler struct {
|
||||
UpgradeRequired bool
|
||||
Location *url.URL
|
||||
Transport http.RoundTripper
|
||||
FlushInterval time.Duration
|
||||
err error
|
||||
}
|
||||
|
||||
const defaultFlushInterval = 200 * time.Millisecond
|
||||
|
||||
// NewUpgradeAwareProxyHandler creates a new proxy handler with a default flush interval
|
||||
func NewUpgradeAwareProxyHandler(location *url.URL, transport http.RoundTripper, upgradeRequired bool) *UpgradeAwareProxyHandler {
|
||||
return &UpgradeAwareProxyHandler{
|
||||
Location: location,
|
||||
Transport: transport,
|
||||
UpgradeRequired: upgradeRequired,
|
||||
FlushInterval: defaultFlushInterval,
|
||||
}
|
||||
}
|
||||
|
||||
// RequestError returns an error that occurred while handling request
|
||||
func (h *UpgradeAwareProxyHandler) RequestError() error {
|
||||
return h.err
|
||||
}
|
||||
|
||||
// ServeHTTP handles the proxy request
|
||||
func (h *UpgradeAwareProxyHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
|
||||
h.err = nil
|
||||
if len(h.Location.Scheme) == 0 {
|
||||
h.Location.Scheme = "http"
|
||||
}
|
||||
if h.tryUpgrade(w, req) {
|
||||
return
|
||||
}
|
||||
if h.UpgradeRequired {
|
||||
h.err = errors.NewBadRequest("Upgrade request required")
|
||||
return
|
||||
}
|
||||
|
||||
if h.Transport == nil {
|
||||
h.Transport = h.defaultProxyTransport(req.URL)
|
||||
}
|
||||
|
||||
loc := *h.Location
|
||||
loc.RawQuery = req.URL.RawQuery
|
||||
newReq, err := http.NewRequest(req.Method, loc.String(), req.Body)
|
||||
if err != nil {
|
||||
h.err = err
|
||||
return
|
||||
}
|
||||
newReq.Header = req.Header
|
||||
|
||||
proxy := httputil.NewSingleHostReverseProxy(&url.URL{Scheme: h.Location.Scheme, Host: h.Location.Host})
|
||||
proxy.Transport = h.Transport
|
||||
proxy.FlushInterval = h.FlushInterval
|
||||
proxy.ServeHTTP(w, newReq)
|
||||
}
|
||||
|
||||
// tryUpgrade returns true if the request was handled.
|
||||
func (h *UpgradeAwareProxyHandler) tryUpgrade(w http.ResponseWriter, req *http.Request) bool {
|
||||
if !httpstream.IsUpgradeRequest(req) {
|
||||
return false
|
||||
}
|
||||
|
||||
backendConn, err := h.dialURL()
|
||||
if err != nil {
|
||||
h.err = err
|
||||
return true
|
||||
}
|
||||
defer backendConn.Close()
|
||||
|
||||
requestHijackedConn, _, err := w.(http.Hijacker).Hijack()
|
||||
if err != nil {
|
||||
h.err = err
|
||||
return true
|
||||
}
|
||||
defer requestHijackedConn.Close()
|
||||
|
||||
newReq, err := http.NewRequest(req.Method, h.Location.String(), req.Body)
|
||||
if err != nil {
|
||||
h.err = err
|
||||
return true
|
||||
}
|
||||
newReq.Header = req.Header
|
||||
|
||||
if err = newReq.Write(backendConn); err != nil {
|
||||
h.err = err
|
||||
return true
|
||||
}
|
||||
|
||||
wg := &sync.WaitGroup{}
|
||||
wg.Add(2)
|
||||
|
||||
go func() {
|
||||
_, err := io.Copy(backendConn, requestHijackedConn)
|
||||
if err != nil && !strings.Contains(err.Error(), "use of closed network connection") {
|
||||
glog.Errorf("Error proxying data from client to backend: %v", err)
|
||||
}
|
||||
wg.Done()
|
||||
}()
|
||||
|
||||
go func() {
|
||||
_, err := io.Copy(requestHijackedConn, backendConn)
|
||||
if err != nil && !strings.Contains(err.Error(), "use of closed network connection") {
|
||||
glog.Errorf("Error proxying data from backend to client: %v", err)
|
||||
}
|
||||
wg.Done()
|
||||
}()
|
||||
|
||||
wg.Wait()
|
||||
return true
|
||||
}
|
||||
|
||||
func (h *UpgradeAwareProxyHandler) dialURL() (net.Conn, error) {
|
||||
dialAddr := netutil.CanonicalAddr(h.Location)
|
||||
|
||||
switch h.Location.Scheme {
|
||||
case "http":
|
||||
return net.Dial("tcp", dialAddr)
|
||||
case "https":
|
||||
// Get the tls config from the transport if we recognize it
|
||||
var tlsConfig *tls.Config
|
||||
if h.Transport != nil {
|
||||
httpTransport, ok := h.Transport.(*http.Transport)
|
||||
if ok {
|
||||
tlsConfig = httpTransport.TLSClientConfig
|
||||
}
|
||||
}
|
||||
|
||||
// Dial
|
||||
tlsConn, err := tls.Dial("tcp", dialAddr, tlsConfig)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Verify
|
||||
host, _, _ := net.SplitHostPort(dialAddr)
|
||||
if err := tlsConn.VerifyHostname(host); err != nil {
|
||||
tlsConn.Close()
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return tlsConn, nil
|
||||
default:
|
||||
return nil, fmt.Errorf("Unknown scheme: %s", h.Location.Scheme)
|
||||
}
|
||||
}
|
||||
|
||||
func (h *UpgradeAwareProxyHandler) defaultProxyTransport(url *url.URL) http.RoundTripper {
|
||||
scheme := url.Scheme
|
||||
host := url.Host
|
||||
pathPrepend := strings.TrimRight(url.Path, h.Location.Path)
|
||||
return &proxy.Transport{
|
||||
Scheme: scheme,
|
||||
Host: host,
|
||||
PathPrepend: pathPrepend,
|
||||
}
|
||||
}
|
||||
242
pkg/registry/generic/rest/proxy_test.go
Normal file
242
pkg/registry/generic/rest/proxy_test.go
Normal file
@@ -0,0 +1,242 @@
|
||||
/*
|
||||
Copyright 2014 Google Inc. All rights reserved.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package rest
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"io"
|
||||
"io/ioutil"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"testing"
|
||||
|
||||
"golang.org/x/net/websocket"
|
||||
)
|
||||
|
||||
type SimpleBackendHandler struct {
|
||||
requestURL url.URL
|
||||
requestHeader http.Header
|
||||
requestBody []byte
|
||||
requestMethod string
|
||||
responseBody string
|
||||
responseHeader map[string]string
|
||||
t *testing.T
|
||||
}
|
||||
|
||||
func (s *SimpleBackendHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
|
||||
s.requestURL = *req.URL
|
||||
s.requestHeader = req.Header
|
||||
s.requestMethod = req.Method
|
||||
var err error
|
||||
s.requestBody, err = ioutil.ReadAll(req.Body)
|
||||
if err != nil {
|
||||
s.t.Errorf("Unexpected error: %v", err)
|
||||
return
|
||||
}
|
||||
|
||||
for k, v := range s.responseHeader {
|
||||
w.Header().Add(k, v)
|
||||
}
|
||||
w.Write([]byte(s.responseBody))
|
||||
}
|
||||
|
||||
func validateParameters(t *testing.T, name string, actual url.Values, expected map[string]string) {
|
||||
for k, v := range expected {
|
||||
actualValue, ok := actual[k]
|
||||
if !ok {
|
||||
t.Errorf("%s: Expected parameter %s not received", name, k)
|
||||
continue
|
||||
}
|
||||
if actualValue[0] != v {
|
||||
t.Errorf("%s: Parameter %s values don't match. Actual: %#v, Expected: %s",
|
||||
name, k, actualValue, v)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func validateHeaders(t *testing.T, name string, actual http.Header, expected map[string]string) {
|
||||
for k, v := range expected {
|
||||
actualValue, ok := actual[k]
|
||||
if !ok {
|
||||
t.Errorf("%s: Expected header %s not received", name, k)
|
||||
continue
|
||||
}
|
||||
if actualValue[0] != v {
|
||||
t.Errorf("%s: Header %s values don't match. Actual: %s, Expected: %s",
|
||||
name, k, actualValue, v)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestServeHTTP(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
method string
|
||||
requestPath string
|
||||
requestBody string
|
||||
requestParams map[string]string
|
||||
requestHeader map[string]string
|
||||
}{
|
||||
{
|
||||
name: "root path, simple get",
|
||||
method: "GET",
|
||||
requestPath: "/",
|
||||
},
|
||||
{
|
||||
name: "simple path, get",
|
||||
method: "GET",
|
||||
requestPath: "/path/to/test",
|
||||
},
|
||||
{
|
||||
name: "request params",
|
||||
method: "POST",
|
||||
requestPath: "/some/path",
|
||||
requestParams: map[string]string{"param1": "value/1", "param2": "value%2"},
|
||||
requestBody: "test request body",
|
||||
},
|
||||
{
|
||||
name: "request headers",
|
||||
method: "PUT",
|
||||
requestPath: "/some/path",
|
||||
requestHeader: map[string]string{"Header1": "value1", "Header2": "value2"},
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range tests {
|
||||
func() {
|
||||
backendResponse := "<html><head></head><body><a href=\"/test/path\">Hello</a></body></html>"
|
||||
backendHandler := &SimpleBackendHandler{
|
||||
responseBody: backendResponse,
|
||||
responseHeader: map[string]string{"Content-Type": "text/html"},
|
||||
}
|
||||
backendServer := httptest.NewServer(backendHandler)
|
||||
defer backendServer.Close()
|
||||
|
||||
backendURL, _ := url.Parse(backendServer.URL)
|
||||
backendURL.Path = test.requestPath
|
||||
proxyHandler := &UpgradeAwareProxyHandler{
|
||||
Location: backendURL,
|
||||
}
|
||||
proxyServer := httptest.NewServer(proxyHandler)
|
||||
defer proxyServer.Close()
|
||||
proxyURL, _ := url.Parse(proxyServer.URL)
|
||||
proxyURL.Path = test.requestPath
|
||||
paramValues := url.Values{}
|
||||
for k, v := range test.requestParams {
|
||||
paramValues[k] = []string{v}
|
||||
}
|
||||
proxyURL.RawQuery = paramValues.Encode()
|
||||
var requestBody io.Reader
|
||||
if test.requestBody != "" {
|
||||
requestBody = bytes.NewBufferString(test.requestBody)
|
||||
}
|
||||
req, err := http.NewRequest(test.method, proxyURL.String(), requestBody)
|
||||
if test.requestHeader != nil {
|
||||
header := http.Header{}
|
||||
for k, v := range test.requestHeader {
|
||||
header.Add(k, v)
|
||||
}
|
||||
req.Header = header
|
||||
}
|
||||
if err != nil {
|
||||
t.Errorf("Error creating client request: %v", err)
|
||||
}
|
||||
client := &http.Client{}
|
||||
res, err := client.Do(req)
|
||||
if err != nil {
|
||||
t.Errorf("Error from proxy request: %v", err)
|
||||
}
|
||||
|
||||
// Validate backend request
|
||||
// Method
|
||||
if backendHandler.requestMethod != test.method {
|
||||
t.Errorf("Unexpected request method: %s. Expected: %s",
|
||||
backendHandler.requestMethod, test.method)
|
||||
}
|
||||
|
||||
// Body
|
||||
if string(backendHandler.requestBody) != test.requestBody {
|
||||
t.Errorf("Unexpected request body: %s. Expected: %s",
|
||||
string(backendHandler.requestBody), test.requestBody)
|
||||
}
|
||||
|
||||
// Path
|
||||
if backendHandler.requestURL.Path != test.requestPath {
|
||||
t.Errorf("Unexpected request path: %s", backendHandler.requestURL.Path)
|
||||
}
|
||||
// Parameters
|
||||
validateParameters(t, test.name, backendHandler.requestURL.Query(), test.requestParams)
|
||||
|
||||
// Headers
|
||||
validateHeaders(t, test.name+" backend request", backendHandler.requestHeader,
|
||||
test.requestHeader)
|
||||
|
||||
// Validate proxy response
|
||||
// Validate Body
|
||||
responseBody, err := ioutil.ReadAll(res.Body)
|
||||
if err != nil {
|
||||
t.Errorf("Unexpected error reading response body: %v", err)
|
||||
}
|
||||
if rb := string(responseBody); rb != backendResponse {
|
||||
t.Errorf("Did not get expected response body: %s. Expected: %s", rb, backendResponse)
|
||||
}
|
||||
|
||||
// Error
|
||||
err = proxyHandler.RequestError()
|
||||
if err != nil {
|
||||
t.Errorf("Unexpected proxy handler error: %v", err)
|
||||
}
|
||||
}()
|
||||
}
|
||||
}
|
||||
|
||||
func TestProxyUpgrade(t *testing.T) {
|
||||
backendServer := httptest.NewServer(websocket.Handler(func(ws *websocket.Conn) {
|
||||
defer ws.Close()
|
||||
body := make([]byte, 5)
|
||||
ws.Read(body)
|
||||
ws.Write([]byte("hello " + string(body)))
|
||||
}))
|
||||
defer backendServer.Close()
|
||||
|
||||
serverURL, _ := url.Parse(backendServer.URL)
|
||||
proxyHandler := &UpgradeAwareProxyHandler{
|
||||
Location: serverURL,
|
||||
}
|
||||
proxy := httptest.NewServer(proxyHandler)
|
||||
defer proxy.Close()
|
||||
|
||||
ws, err := websocket.Dial("ws://"+proxy.Listener.Addr().String()+"/some/path", "", "http://127.0.0.1/")
|
||||
if err != nil {
|
||||
t.Fatalf("websocket dial err: %s", err)
|
||||
}
|
||||
defer ws.Close()
|
||||
|
||||
if _, err := ws.Write([]byte("world")); err != nil {
|
||||
t.Fatalf("write err: %s", err)
|
||||
}
|
||||
|
||||
response := make([]byte, 20)
|
||||
n, err := ws.Read(response)
|
||||
if err != nil {
|
||||
t.Fatalf("read err: %s", err)
|
||||
}
|
||||
if e, a := "hello world", string(response[0:n]); e != a {
|
||||
t.Fatalf("expected '%#v', got '%#v'", e, a)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user