vendor files

vendor/k8s.io/kubernetes/pkg/kubectl/proxy/BUILD

@@ -0,0 +1,45 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["proxy_server_test.go"],
+    importpath = "k8s.io/kubernetes/pkg/kubectl/proxy",
+    library = ":go_default_library",
+    deps = [
+        "//vendor/k8s.io/apimachinery/pkg/util/proxy:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+    ],
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["proxy_server.go"],
+    importpath = "k8s.io/kubernetes/pkg/kubectl/proxy",
+    deps = [
+        "//pkg/kubectl/util:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/net:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/proxy:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/transport:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/kubernetes/pkg/kubectl/proxy/proxy_server.go

@@ -0,0 +1,282 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/golang/glog"
+	utilnet "k8s.io/apimachinery/pkg/util/net"
+	"k8s.io/apimachinery/pkg/util/proxy"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/transport"
+	"k8s.io/kubernetes/pkg/kubectl/util"
+)
+
+const (
+	// DefaultHostAcceptRE is the default value for which hosts to accept.
+	DefaultHostAcceptRE = "^localhost$,^127\\.0\\.0\\.1$,^\\[::1\\]$"
+	// DefaultPathAcceptRE is the default path to accept.
+	DefaultPathAcceptRE = "^.*"
+	// DefaultPathRejectRE is the default set of paths to reject.
+	DefaultPathRejectRE = "^/api/.*/pods/.*/exec,^/api/.*/pods/.*/attach"
+	// DefaultMethodRejectRE is the set of HTTP methods to reject by default.
+	DefaultMethodRejectRE = "^$"
+)
+
+var (
+	// ReverseProxyFlushInterval is the frequency to flush the reverse proxy.
+	// Only matters for long poll connections like the one used to watch. With an
+	// interval of 0 the reverse proxy will buffer content sent on any connection
+	// with transfer-encoding=chunked.
+	// TODO: Flush after each chunk so the client doesn't suffer a 100ms latency per
+	// watch event.
+	ReverseProxyFlushInterval = 100 * time.Millisecond
+)
+
+// FilterServer rejects requests which don't match one of the specified regular expressions
+type FilterServer struct {
+	// Only paths that match this regexp will be accepted
+	AcceptPaths []*regexp.Regexp
+	// Paths that match this regexp will be rejected, even if they match the above
+	RejectPaths []*regexp.Regexp
+	// Hosts are required to match this list of regexp
+	AcceptHosts []*regexp.Regexp
+	// Methods that match this regexp are rejected
+	RejectMethods []*regexp.Regexp
+	// The delegate to call to handle accepted requests.
+	delegate http.Handler
+}
+
+// MakeRegexpArray splits a comma separated list of regexps into an array of Regexp objects.
+func MakeRegexpArray(str string) ([]*regexp.Regexp, error) {
+	parts := strings.Split(str, ",")
+	result := make([]*regexp.Regexp, len(parts))
+	for ix := range parts {
+		re, err := regexp.Compile(parts[ix])
+		if err != nil {
+			return nil, err
+		}
+		result[ix] = re
+	}
+	return result, nil
+}
+
+// MakeRegexpArrayOrDie creates an array of regular expression objects from a string or exits.
+func MakeRegexpArrayOrDie(str string) []*regexp.Regexp {
+	result, err := MakeRegexpArray(str)
+	if err != nil {
+		glog.Fatalf("Error compiling re: %v", err)
+	}
+	return result
+}
+
+func matchesRegexp(str string, regexps []*regexp.Regexp) bool {
+	for _, re := range regexps {
+		if re.MatchString(str) {
+			glog.V(6).Infof("%v matched %s", str, re)
+			return true
+		}
+	}
+	return false
+}
+
+func (f *FilterServer) accept(method, path, host string) bool {
+	if matchesRegexp(path, f.RejectPaths) {
+		return false
+	}
+	if matchesRegexp(method, f.RejectMethods) {
+		return false
+	}
+	if matchesRegexp(path, f.AcceptPaths) && matchesRegexp(host, f.AcceptHosts) {
+		return true
+	}
+	return false
+}
+
+// HandlerFor makes a shallow copy of f which passes its requests along to the
+// new delegate.
+func (f *FilterServer) HandlerFor(delegate http.Handler) *FilterServer {
+	f2 := *f
+	f2.delegate = delegate
+	return &f2
+}
+
+// Get host from a host header value like "localhost" or "localhost:8080"
+func extractHost(header string) (host string) {
+	host, _, err := net.SplitHostPort(header)
+	if err != nil {
+		host = header
+	}
+	return host
+}
+
+func (f *FilterServer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	host := extractHost(req.Host)
+	if f.accept(req.Method, req.URL.Path, host) {
+		glog.V(3).Infof("Filter accepting %v %v %v", req.Method, req.URL.Path, host)
+		f.delegate.ServeHTTP(rw, req)
+		return
+	}
+	glog.V(3).Infof("Filter rejecting %v %v %v", req.Method, req.URL.Path, host)
+	rw.WriteHeader(http.StatusForbidden)
+	rw.Write([]byte("<h3>Unauthorized</h3>"))
+}
+
+// Server is a http.Handler which proxies Kubernetes APIs to remote API server.
+type Server struct {
+	handler http.Handler
+}
+
+type responder struct{}
+
+func (r *responder) Error(w http.ResponseWriter, req *http.Request, err error) {
+	glog.Errorf("Error while proxying request: %v", err)
+	http.Error(w, err.Error(), http.StatusInternalServerError)
+}
+
+// makeUpgradeTransport creates a transport that explicitly bypasses HTTP2 support
+// for proxy connections that must upgrade.
+func makeUpgradeTransport(config *rest.Config) (proxy.UpgradeRequestRoundTripper, error) {
+	transportConfig, err := config.TransportConfig()
+	if err != nil {
+		return nil, err
+	}
+	tlsConfig, err := transport.TLSConfigFor(transportConfig)
+	if err != nil {
+		return nil, err
+	}
+	rt := utilnet.SetOldTransportDefaults(&http.Transport{
+		TLSClientConfig: tlsConfig,
+	})
+	upgrader, err := transport.HTTPWrappersForConfig(transportConfig, proxy.MirrorRequest)
+	if err != nil {
+		return nil, err
+	}
+	return proxy.NewUpgradeRequestRoundTripper(rt, upgrader), nil
+}
+
+// NewServer creates and installs a new Server.
+// 'filter', if non-nil, protects requests to the api only.
+func NewServer(filebase string, apiProxyPrefix string, staticPrefix string, filter *FilterServer, cfg *rest.Config) (*Server, error) {
+	host := cfg.Host
+	if !strings.HasSuffix(host, "/") {
+		host = host + "/"
+	}
+	target, err := url.Parse(host)
+	if err != nil {
+		return nil, err
+	}
+
+	responder := &responder{}
+	transport, err := rest.TransportFor(cfg)
+	if err != nil {
+		return nil, err
+	}
+	upgradeTransport, err := makeUpgradeTransport(cfg)
+	if err != nil {
+		return nil, err
+	}
+	proxy := proxy.NewUpgradeAwareHandler(target, transport, false, false, responder)
+	proxy.UpgradeTransport = upgradeTransport
+	proxy.UseRequestLocation = true
+
+	proxyServer := http.Handler(proxy)
+	if filter != nil {
+		proxyServer = filter.HandlerFor(proxyServer)
+	}
+
+	if !strings.HasPrefix(apiProxyPrefix, "/api") {
+		proxyServer = stripLeaveSlash(apiProxyPrefix, proxyServer)
+	}
+
+	mux := http.NewServeMux()
+	mux.Handle(apiProxyPrefix, proxyServer)
+	if filebase != "" {
+		// Require user to explicitly request this behavior rather than
+		// serving their working directory by default.
+		mux.Handle(staticPrefix, newFileHandler(staticPrefix, filebase))
+	}
+	return &Server{handler: mux}, nil
+}
+
+// Listen is a simple wrapper around net.Listen.
+func (s *Server) Listen(address string, port int) (net.Listener, error) {
+	return net.Listen("tcp", fmt.Sprintf("%s:%d", address, port))
+}
+
+// ListenUnix does net.Listen for a unix socket
+func (s *Server) ListenUnix(path string) (net.Listener, error) {
+	// Remove any socket, stale or not, but fall through for other files
+	fi, err := os.Stat(path)
+	if err == nil && (fi.Mode()&os.ModeSocket) != 0 {
+		os.Remove(path)
+	}
+	// Default to only user accessible socket, caller can open up later if desired
+	oldmask, _ := util.Umask(0077)
+	l, err := net.Listen("unix", path)
+	util.Umask(oldmask)
+	return l, err
+}
+
+// ServeOnListener starts the server using given listener, loops forever.
+func (s *Server) ServeOnListener(l net.Listener) error {
+	server := http.Server{
+		Handler: s.handler,
+	}
+	return server.Serve(l)
+}
+
+func newFileHandler(prefix, base string) http.Handler {
+	return http.StripPrefix(prefix, http.FileServer(http.Dir(base)))
+}
+
+func singleJoiningSlash(a, b string) string {
+	aslash := strings.HasSuffix(a, "/")
+	bslash := strings.HasPrefix(b, "/")
+	switch {
+	case aslash && bslash:
+		return a + b[1:]
+	case !aslash && !bslash:
+		return a + "/" + b
+	}
+	return a + b
+}
+
+// like http.StripPrefix, but always leaves an initial slash. (so that our
+// regexps will work.)
+func stripLeaveSlash(prefix string, h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		p := strings.TrimPrefix(req.URL.Path, prefix)
+		if len(p) >= len(req.URL.Path) {
+			http.NotFound(w, req)
+			return
+		}
+		if len(p) > 0 && p[:1] != "/" {
+			p = "/" + p
+		}
+		req.URL.Path = p
+		h.ServeHTTP(w, req)
+	})
+}

vendor/k8s.io/kubernetes/pkg/kubectl/proxy/proxy_server_test.go

@@ -0,0 +1,455 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/proxy"
+	"k8s.io/client-go/rest"
+)
+
+func TestAccept(t *testing.T) {
+	tests := []struct {
+		acceptPaths   string
+		rejectPaths   string
+		acceptHosts   string
+		rejectMethods string
+		path          string
+		host          string
+		method        string
+		expectAccept  bool
+	}{
+
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "",
+			host:          "127.0.0.1",
+			method:        "GET",
+			expectAccept:  true,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/api/v1/pods",
+			host:          "127.0.0.1",
+			method:        "GET",
+			expectAccept:  true,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/api/v1/pods",
+			host:          "localhost",
+			method:        "GET",
+			expectAccept:  true,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/api/v1/namespaces/default/pods/foo",
+			host:          "localhost",
+			method:        "GET",
+			expectAccept:  true,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/api/v1/namespaces/default/pods/attachfoo",
+			host:          "localhost",
+			method:        "GET",
+			expectAccept:  true,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/api/v1/namespaces/default/pods/execfoo",
+			host:          "localhost",
+			method:        "GET",
+			expectAccept:  true,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/api/v1/namespaces/default/pods/foo/exec",
+			host:          "127.0.0.1",
+			method:        "GET",
+			expectAccept:  false,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/api/v1/namespaces/default/pods/foo/attach",
+			host:          "127.0.0.1",
+			method:        "GET",
+			expectAccept:  false,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/api/v1/pods",
+			host:          "evil.com",
+			method:        "GET",
+			expectAccept:  false,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/api/v1/pods",
+			host:          "localhost.evil.com",
+			method:        "GET",
+			expectAccept:  false,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/api/v1/pods",
+			host:          "127a0b0c1",
+			method:        "GET",
+			expectAccept:  false,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/ui",
+			host:          "localhost",
+			method:        "GET",
+			expectAccept:  true,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/api/v1/pods",
+			host:          "localhost",
+			method:        "POST",
+			expectAccept:  true,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/api/v1/namespaces/default/pods/somepod",
+			host:          "localhost",
+			method:        "PUT",
+			expectAccept:  true,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: DefaultMethodRejectRE,
+			path:          "/api/v1/namespaces/default/pods/somepod",
+			host:          "localhost",
+			method:        "PATCH",
+			expectAccept:  true,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: "GET",
+			path:          "/api/v1/pods",
+			host:          "127.0.0.1",
+			method:        "GET",
+			expectAccept:  false,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: "POST",
+			path:          "/api/v1/pods",
+			host:          "localhost",
+			method:        "POST",
+			expectAccept:  false,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: "PUT",
+			path:          "/api/v1/namespaces/default/pods/somepod",
+			host:          "localhost",
+			method:        "PUT",
+			expectAccept:  false,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: "PATCH",
+			path:          "/api/v1/namespaces/default/pods/somepod",
+			host:          "localhost",
+			method:        "PATCH",
+			expectAccept:  false,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: "POST,PUT,PATCH",
+			path:          "/api/v1/namespaces/default/pods/somepod",
+			host:          "localhost",
+			method:        "PATCH",
+			expectAccept:  false,
+		},
+		{
+			acceptPaths:   DefaultPathAcceptRE,
+			rejectPaths:   DefaultPathRejectRE,
+			acceptHosts:   DefaultHostAcceptRE,
+			rejectMethods: "POST,PUT,PATCH",
+			path:          "/api/v1/namespaces/default/pods/somepod",
+			host:          "localhost",
+			method:        "PUT",
+			expectAccept:  false,
+		},
+	}
+	for _, test := range tests {
+		filter := &FilterServer{
+			AcceptPaths:   MakeRegexpArrayOrDie(test.acceptPaths),
+			RejectPaths:   MakeRegexpArrayOrDie(test.rejectPaths),
+			AcceptHosts:   MakeRegexpArrayOrDie(test.acceptHosts),
+			RejectMethods: MakeRegexpArrayOrDie(test.rejectMethods),
+		}
+		accept := filter.accept(test.method, test.path, test.host)
+		if accept != test.expectAccept {
+			t.Errorf("expected: %v, got %v for %#v", test.expectAccept, accept, test)
+		}
+	}
+}
+
+func TestRegexpMatch(t *testing.T) {
+	tests := []struct {
+		str         string
+		regexps     string
+		expectMatch bool
+	}{
+		{
+			str:         "foo",
+			regexps:     "bar,.*",
+			expectMatch: true,
+		},
+		{
+			str:         "foo",
+			regexps:     "bar,fo.*",
+			expectMatch: true,
+		},
+		{
+			str:         "bar",
+			regexps:     "bar,fo.*",
+			expectMatch: true,
+		},
+		{
+			str:         "baz",
+			regexps:     "bar,fo.*",
+			expectMatch: false,
+		},
+	}
+	for _, test := range tests {
+		match := matchesRegexp(test.str, MakeRegexpArrayOrDie(test.regexps))
+		if test.expectMatch != match {
+			t.Errorf("expected: %v, found: %v, for %s and %v", test.expectMatch, match, test.str, test.regexps)
+		}
+	}
+}
+
+func TestFileServing(t *testing.T) {
+	const (
+		fname = "test.txt"
+		data  = "This is test data"
+	)
+	dir, err := ioutil.TempDir("", "data")
+	if err != nil {
+		t.Fatalf("error creating tmp dir: %v", err)
+	}
+	defer os.RemoveAll(dir)
+	if err := ioutil.WriteFile(filepath.Join(dir, fname), []byte(data), 0755); err != nil {
+		t.Fatalf("error writing tmp file: %v", err)
+	}
+
+	const prefix = "/foo/"
+	handler := newFileHandler(prefix, dir)
+	server := httptest.NewServer(handler)
+	defer server.Close()
+
+	url := server.URL + prefix + fname
+	res, err := http.Get(url)
+	if err != nil {
+		t.Fatalf("http.Get(%q) error: %v", url, err)
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode != http.StatusOK {
+		t.Errorf("res.StatusCode = %d; want %d", res.StatusCode, http.StatusOK)
+	}
+	b, err := ioutil.ReadAll(res.Body)
+	if err != nil {
+		t.Fatalf("error reading resp body: %v", err)
+	}
+	if string(b) != data {
+		t.Errorf("have %q; want %q", string(b), data)
+	}
+}
+
+func newProxy(target *url.URL) http.Handler {
+	p := proxy.NewUpgradeAwareHandler(target, http.DefaultTransport, false, false, &responder{})
+	p.UseRequestLocation = true
+	return p
+}
+
+func TestAPIRequests(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		b, err := ioutil.ReadAll(r.Body)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		fmt.Fprintf(w, "%s %s %s", r.Method, r.RequestURI, string(b))
+	}))
+	defer ts.Close()
+
+	// httptest.NewServer should always generate a valid URL.
+	target, _ := url.Parse(ts.URL)
+	target.Path = "/"
+	proxy := newProxy(target)
+
+	tests := []struct{ method, body string }{
+		{"GET", ""},
+		{"DELETE", ""},
+		{"POST", "test payload"},
+		{"PUT", "test payload"},
+	}
+
+	const path = "/api/test?fields=ID%3Dfoo&labels=key%3Dvalue"
+	for i, tt := range tests {
+		r, err := http.NewRequest(tt.method, path, strings.NewReader(tt.body))
+		if err != nil {
+			t.Errorf("error creating request: %v", err)
+			continue
+		}
+		w := httptest.NewRecorder()
+		proxy.ServeHTTP(w, r)
+		if w.Code != http.StatusOK {
+			t.Errorf("%d: proxy.ServeHTTP w.Code = %d; want %d", i, w.Code, http.StatusOK)
+		}
+		want := strings.Join([]string{tt.method, path, tt.body}, " ")
+		if w.Body.String() != want {
+			t.Errorf("%d: response body = %q; want %q", i, w.Body.String(), want)
+		}
+	}
+}
+
+func TestPathHandling(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, r.URL.Path)
+	}))
+	defer ts.Close()
+
+	table := []struct {
+		prefix     string
+		reqPath    string
+		expectPath string
+	}{
+		{"/api/", "/metrics", "404 page not found\n"},
+		{"/api/", "/api/metrics", "/api/metrics"},
+		{"/api/", "/api/v1/pods/", "/api/v1/pods/"},
+		{"/", "/metrics", "/metrics"},
+		{"/", "/api/v1/pods/", "/api/v1/pods/"},
+		{"/custom/", "/metrics", "404 page not found\n"},
+		{"/custom/", "/api/metrics", "404 page not found\n"},
+		{"/custom/", "/api/v1/pods/", "404 page not found\n"},
+		{"/custom/", "/custom/api/metrics", "/api/metrics"},
+		{"/custom/", "/custom/api/v1/pods/", "/api/v1/pods/"},
+	}
+
+	cc := &rest.Config{
+		Host: ts.URL,
+	}
+
+	for _, item := range table {
+		func() {
+			p, err := NewServer("", item.prefix, "/not/used/for/this/test", nil, cc)
+			if err != nil {
+				t.Fatalf("%#v: %v", item, err)
+			}
+			pts := httptest.NewServer(p.handler)
+			defer pts.Close()
+
+			r, err := http.Get(pts.URL + item.reqPath)
+			if err != nil {
+				t.Fatalf("%#v: %v", item, err)
+			}
+			body, err := ioutil.ReadAll(r.Body)
+			r.Body.Close()
+			if err != nil {
+				t.Fatalf("%#v: %v", item, err)
+			}
+			if e, a := item.expectPath, string(body); e != a {
+				t.Errorf("%#v: Wanted %q, got %q", item, e, a)
+			}
+		}()
+	}
+}
+
+func TestExtractHost(t *testing.T) {
+	fixtures := map[string]string{
+		"localhost:8085": "localhost",
+		"marmalade":      "marmalade",
+	}
+	for header, expected := range fixtures {
+		host := extractHost(header)
+		if host != expected {
+			t.Fatalf("%s != %s", host, expected)
+		}
+	}
+}