Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proxy server readiness check needs to respect auth #191

Open
jinnovation opened this issue Apr 20, 2024 · 2 comments
Open

Proxy server readiness check needs to respect auth #191

jinnovation opened this issue Apr 20, 2024 · 2 comments

Comments

@jinnovation
Copy link
Owner

jinnovation commented Apr 20, 2024

Not all users have permission to query /readyz or /livez; attempting to do so returns an error.

> curl 127.0.0.1:8001/readyz
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "Unauthorized",
  "reason": "Unauthorized",
  "code": 401
}%                                                                                                                     

Currently, attempting to create a proxy server via kele.el in such scenarios simply retries over and over again (ready-p drops the error) until it eventually fails.

Two things need to happen (not necessarily all in this ticket):

  1. ready-p needs to detect no-auth scenario and fail immediately
  2. proxy-get needs a different wait mechanism if user does not have the right auth.
@jinnovation
Copy link
Owner Author

Might be able to use SelfSubjectAccessReview to check if user has permission to query readyz and livez. Specifically, .spec.nonResourceAttributes.

@jinnovation
Copy link
Owner Author

Turns out this can be due to the user not being logged into the server. Example output from kubectl auth can-i:

> kubectl auth can-i get /authz
error: You must be logged in to the server (Unauthorized)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant