Commit a38fc047 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub

Merge pull request #34615 from Calpicow/master

Automatic merge from submit-queue Use same SSH tunnel as kubelet Provides a secure workaround for #11816 by having kube-apiserver use the same SSH tunnel as the kubelet it is trying to connect to. Use in conjunction with iptables or kubelet `--address=127.0.0.1`. The latter will break heapster. Will fallback to random behavior if the tunnel cannot be found.
parents f418cd3d 6f9fd443
......@@ -32,6 +32,7 @@ import (
"net/http"
"net/url"
"os"
"strings"
"sync"
"time"
......@@ -391,19 +392,27 @@ func (l *SSHTunnelList) Dial(net, addr string) (net.Conn, error) {
defer func() {
glog.Infof("[%x: %v] Dialed in %v.", id, addr, time.Now().Sub(start))
}()
tunnel, err := l.pickRandomTunnel()
tunnel, err := l.pickTunnel(strings.Split(addr, ":")[0])
if err != nil {
return nil, err
}
return tunnel.Dial(net, addr)
}
func (l *SSHTunnelList) pickRandomTunnel() (tunnel, error) {
func (l *SSHTunnelList) pickTunnel(addr string) (tunnel, error) {
l.tunnelsLock.Lock()
defer l.tunnelsLock.Unlock()
if len(l.entries) == 0 {
return nil, fmt.Errorf("No SSH tunnels currently open. Were the targets able to accept an ssh-key for user %q?", l.user)
}
// Prefer same tunnel as kubelet
// TODO: Change l.entries to a map of address->tunnel
for _, entry := range l.entries {
if entry.Address == addr {
return entry.Tunnel, nil
}
}
glog.Warningf("SSH tunnel not found for address %q, picking random node", addr)
n := mathrand.Intn(len(l.entries))
return l.entries[n].Tunnel, nil
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment