rebase: update kubernetes to 1.28.3

update kubernetes dependency to 1.28.3
release.

Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
This commit is contained in:
Madhu Rajanna
2023-10-19 10:42:48 +02:00
committed by mergify[bot]
parent 1fc9678342
commit 852b829fa9
13 changed files with 207 additions and 138 deletions

View File

@ -126,14 +126,17 @@ type rudimentaryErrorBackoff struct {
// OnError will block if it is called more often than the embedded period time.
// This will prevent overly tight hot error loops.
func (r *rudimentaryErrorBackoff) OnError(error) {
now := time.Now() // start the timer before acquiring the lock
r.lastErrorTimeLock.Lock()
defer r.lastErrorTimeLock.Unlock()
d := time.Since(r.lastErrorTime)
if d < r.minPeriod {
// If the time moves backwards for any reason, do nothing
time.Sleep(r.minPeriod - d)
}
d := now.Sub(r.lastErrorTime)
r.lastErrorTime = time.Now()
r.lastErrorTimeLock.Unlock()
// Do not sleep with the lock held because that causes all callers of HandleError to block.
// We only want the current goroutine to block.
// A negative or zero duration causes time.Sleep to return immediately.
// If the time moves backwards for any reason, do nothing.
time.Sleep(r.minPeriod - d)
}
// GetCaller returns the caller of the function that calls it.

View File

@ -29,8 +29,11 @@ import (
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/apiserver/pkg/authentication/authenticatorfactory"
"k8s.io/apiserver/pkg/authentication/request/headerrequest"
"k8s.io/apiserver/pkg/authentication/user"
"k8s.io/apiserver/pkg/endpoints/handlers/responsewriters"
genericapirequest "k8s.io/apiserver/pkg/endpoints/request"
genericfeatures "k8s.io/apiserver/pkg/features"
utilfeature "k8s.io/apiserver/pkg/util/feature"
"k8s.io/klog/v2"
)
@ -101,6 +104,18 @@ func withAuthentication(handler http.Handler, auth authenticator.Request, failed
)
}
// http2 is an expensive protocol that is prone to abuse,
// see CVE-2023-44487 and CVE-2023-39325 for an example.
// Do not allow unauthenticated clients to keep these
// connections open (i.e. basically degrade them to the
// performance of http1 with keep-alive disabled).
if utilfeature.DefaultFeatureGate.Enabled(genericfeatures.UnauthenticatedHTTP2DOSMitigation) && req.ProtoMajor == 2 && isAnonymousUser(resp.User) {
// limit this connection to just this request,
// and then send a GOAWAY and tear down the TCP connection
// https://github.com/golang/net/commit/97aa3a539ec716117a9d15a4659a911f50d13c3c
w.Header().Set("Connection", "close")
}
req = req.WithContext(genericapirequest.WithUser(req.Context(), resp.User))
handler.ServeHTTP(w, req)
})
@ -108,6 +123,17 @@ func withAuthentication(handler http.Handler, auth authenticator.Request, failed
func Unauthorized(s runtime.NegotiatedSerializer) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
// http2 is an expensive protocol that is prone to abuse,
// see CVE-2023-44487 and CVE-2023-39325 for an example.
// Do not allow unauthenticated clients to keep these
// connections open (i.e. basically degrade them to the
// performance of http1 with keep-alive disabled).
if utilfeature.DefaultFeatureGate.Enabled(genericfeatures.UnauthenticatedHTTP2DOSMitigation) && req.ProtoMajor == 2 {
// limit this connection to just this request,
// and then send a GOAWAY and tear down the TCP connection
// https://github.com/golang/net/commit/97aa3a539ec716117a9d15a4659a911f50d13c3c
w.Header().Set("Connection", "close")
}
ctx := req.Context()
requestInfo, found := genericapirequest.RequestInfoFrom(ctx)
if !found {
@ -127,3 +153,15 @@ func audiencesAreAcceptable(apiAuds, responseAudiences authenticator.Audiences)
return len(apiAuds.Intersect(responseAudiences)) > 0
}
func isAnonymousUser(u user.Info) bool {
if u.GetName() == user.Anonymous {
return true
}
for _, group := range u.GetGroups() {
if group == user.AllUnauthenticated {
return true
}
}
return false
}

View File

@ -182,6 +182,24 @@ const (
// Enables server-side field validation.
ServerSideFieldValidation featuregate.Feature = "ServerSideFieldValidation"
// owner: @enj
// beta: v1.29
//
// Enables http2 DOS mitigations for unauthenticated clients.
//
// Some known reasons to disable these mitigations:
//
// An API server that is fronted by an L7 load balancer that is set up
// to mitigate http2 attacks may opt to disable this protection to prevent
// unauthenticated clients from disabling connection reuse between the load
// balancer and the API server (many incoming connections could share the
// same backend connection).
//
// An API server that is on a private network may opt to disable this
// protection to prevent performance regressions for unauthenticated
// clients.
UnauthenticatedHTTP2DOSMitigation featuregate.Feature = "UnauthenticatedHTTP2DOSMitigation"
// owner: @caesarxuchao @roycaihw
// alpha: v1.20
//
@ -276,6 +294,8 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS
StorageVersionHash: {Default: true, PreRelease: featuregate.Beta},
UnauthenticatedHTTP2DOSMitigation: {Default: false, PreRelease: featuregate.Beta},
WatchBookmark: {Default: true, PreRelease: featuregate.GA, LockToDefault: true},
InPlacePodVerticalScaling: {Default: false, PreRelease: featuregate.Alpha},

View File

@ -43,12 +43,13 @@ import (
"k8s.io/apiserver/pkg/apis/config/validation"
"k8s.io/apiserver/pkg/features"
"k8s.io/apiserver/pkg/server/healthz"
"k8s.io/apiserver/pkg/server/options/encryptionconfig/metrics"
storagevalue "k8s.io/apiserver/pkg/storage/value"
aestransformer "k8s.io/apiserver/pkg/storage/value/encrypt/aes"
"k8s.io/apiserver/pkg/storage/value/encrypt/envelope"
envelopekmsv2 "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2"
kmstypes "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2/v2"
"k8s.io/apiserver/pkg/storage/value/encrypt/envelope/metrics"
envelopemetrics "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/metrics"
"k8s.io/apiserver/pkg/storage/value/encrypt/identity"
"k8s.io/apiserver/pkg/storage/value/encrypt/secretbox"
utilfeature "k8s.io/apiserver/pkg/util/feature"
@ -104,6 +105,12 @@ const (
kmsReloadHealthCheckName = "kms-providers"
)
func init() {
metrics.RegisterMetrics()
storagevalue.RegisterMetrics()
envelopemetrics.RegisterMetrics()
}
type kmsPluginHealthzResponse struct {
err error
received time.Time
@ -445,10 +452,10 @@ func (h *kmsv2PluginProbe) isKMSv2ProviderHealthyAndMaybeRotateDEK(ctx context.C
}
if errCode, err := envelopekmsv2.ValidateKeyID(response.KeyID); err != nil {
metrics.RecordInvalidKeyIDFromStatus(h.name, string(errCode))
envelopemetrics.RecordInvalidKeyIDFromStatus(h.name, string(errCode))
errs = append(errs, fmt.Errorf("got invalid KMSv2 KeyID hash %q: %w", envelopekmsv2.GetHashIfNotEmpty(response.KeyID), err))
} else {
metrics.RecordKeyIDFromStatus(h.name, response.KeyID)
envelopemetrics.RecordKeyIDFromStatus(h.name, response.KeyID)
// unconditionally append as we filter out nil errors below
errs = append(errs, h.rotateDEKOnKeyIDChange(ctx, response.KeyID, string(uuid.NewUUID())))
}

View File

@ -189,7 +189,10 @@ func (s *SecureServingInfo) Serve(handler http.Handler, shutdownTimeout time.Dur
if s.HTTP2MaxStreamsPerConnection > 0 {
http2Options.MaxConcurrentStreams = uint32(s.HTTP2MaxStreamsPerConnection)
} else {
http2Options.MaxConcurrentStreams = 250
// match http2.initialMaxConcurrentStreams used by clients
// this makes it so that a malicious client can only open 400 streams before we forcibly close the connection
// https://github.com/golang/net/commit/b225e7ca6dde1ef5a5ae5ce922861bda011cfabd
http2Options.MaxConcurrentStreams = 100
}
// increase the connection buffer size from the 1MB default to handle the specified number of concurrent streams

View File

@ -157,10 +157,10 @@ func newETCD3Check(c storagebackend.Config, timeout time.Duration, stopCh <-chan
var prober *etcd3ProberMonitor
clientErr := fmt.Errorf("etcd client connection not yet established")
go wait.PollUntil(time.Second, func() (bool, error) {
newProber, err := newETCD3ProberMonitor(c)
go wait.PollImmediateUntil(time.Second, func() (bool, error) {
lock.Lock()
defer lock.Unlock()
newProber, err := newETCD3ProberMonitor(c)
// Ensure that server is already not shutting down.
select {
case <-stopCh:

View File

@ -1210,6 +1210,8 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS
genericfeatures.ServerSideFieldValidation: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.29
genericfeatures.UnauthenticatedHTTP2DOSMitigation: {Default: false, PreRelease: featuregate.Beta},
// inherited features from apiextensions-apiserver, relisted here to get a conflict if it is changed
// unintentionally on either side:

View File

@ -581,10 +581,11 @@ func WaitForPodsResponding(ctx context.Context, c clientset.Interface, ns string
if err != nil {
// We may encounter errors here because of a race between the pod readiness and apiserver
// proxy. So, we log the error and retry if this occurs.
return nil, fmt.Errorf("Controller %s: failed to Get from replica pod %s:\n%s\nPod status:\n%s",
// proxy or because of temporary failures. The error gets wrapped for framework.HandleRetry.
// Gomega+Ginkgo will handle logging.
return nil, fmt.Errorf("controller %s: failed to Get from replica pod %s:\n%w\nPod status:\n%s",
controllerName, pod.Name,
format.Object(err, 1), format.Object(pod.Status, 1))
err, format.Object(pod.Status, 1))
}
responses = append(responses, response{podName: pod.Name, response: string(body)})
}

84
vendor/modules.txt vendored
View File

@ -851,7 +851,7 @@ gopkg.in/yaml.v2
# gopkg.in/yaml.v3 v3.0.1
## explicit
gopkg.in/yaml.v3
# k8s.io/api v0.28.2 => k8s.io/api v0.28.2
# k8s.io/api v0.28.3 => k8s.io/api v0.28.3
## explicit; go 1.20
k8s.io/api/admission/v1
k8s.io/api/admission/v1beta1
@ -907,12 +907,12 @@ k8s.io/api/scheduling/v1beta1
k8s.io/api/storage/v1
k8s.io/api/storage/v1alpha1
k8s.io/api/storage/v1beta1
# k8s.io/apiextensions-apiserver v0.28.0 => k8s.io/apiextensions-apiserver v0.28.2
# k8s.io/apiextensions-apiserver v0.28.3 => k8s.io/apiextensions-apiserver v0.28.3
## explicit; go 1.20
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1
k8s.io/apiextensions-apiserver/pkg/features
# k8s.io/apimachinery v0.28.2 => k8s.io/apimachinery v0.28.2
# k8s.io/apimachinery v0.28.3 => k8s.io/apimachinery v0.28.3
## explicit; go 1.20
k8s.io/apimachinery/pkg/api/equality
k8s.io/apimachinery/pkg/api/errors
@ -974,7 +974,7 @@ k8s.io/apimachinery/pkg/watch
k8s.io/apimachinery/third_party/forked/golang/json
k8s.io/apimachinery/third_party/forked/golang/netutil
k8s.io/apimachinery/third_party/forked/golang/reflect
# k8s.io/apiserver v0.28.2 => k8s.io/apiserver v0.28.2
# k8s.io/apiserver v0.28.3 => k8s.io/apiserver v0.28.3
## explicit; go 1.20
k8s.io/apiserver/pkg/admission
k8s.io/apiserver/pkg/admission/cel
@ -1119,7 +1119,7 @@ k8s.io/apiserver/plugin/pkg/audit/truncate
k8s.io/apiserver/plugin/pkg/audit/webhook
k8s.io/apiserver/plugin/pkg/authenticator/token/webhook
k8s.io/apiserver/plugin/pkg/authorizer/webhook
# k8s.io/client-go v12.0.0+incompatible => k8s.io/client-go v0.28.2
# k8s.io/client-go v12.0.0+incompatible => k8s.io/client-go v0.28.3
## explicit; go 1.20
k8s.io/client-go/applyconfigurations/admissionregistration/v1
k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1
@ -1388,7 +1388,7 @@ k8s.io/client-go/util/homedir
k8s.io/client-go/util/keyutil
k8s.io/client-go/util/retry
k8s.io/client-go/util/workqueue
# k8s.io/cloud-provider v0.28.2 => k8s.io/cloud-provider v0.28.2
# k8s.io/cloud-provider v0.28.3 => k8s.io/cloud-provider v0.28.3
## explicit; go 1.20
k8s.io/cloud-provider
k8s.io/cloud-provider/app/config
@ -1403,7 +1403,7 @@ k8s.io/cloud-provider/names
k8s.io/cloud-provider/options
k8s.io/cloud-provider/volume
k8s.io/cloud-provider/volume/helpers
# k8s.io/component-base v0.28.2 => k8s.io/component-base v0.28.2
# k8s.io/component-base v0.28.3 => k8s.io/component-base v0.28.3
## explicit; go 1.20
k8s.io/component-base/cli/flag
k8s.io/component-base/config
@ -1425,12 +1425,12 @@ k8s.io/component-base/metrics/testutil
k8s.io/component-base/tracing
k8s.io/component-base/tracing/api/v1
k8s.io/component-base/version
# k8s.io/component-helpers v0.28.2 => k8s.io/component-helpers v0.28.2
# k8s.io/component-helpers v0.28.3 => k8s.io/component-helpers v0.28.3
## explicit; go 1.20
k8s.io/component-helpers/scheduling/corev1
k8s.io/component-helpers/scheduling/corev1/nodeaffinity
k8s.io/component-helpers/storage/volume
# k8s.io/controller-manager v0.28.2 => k8s.io/controller-manager v0.28.2
# k8s.io/controller-manager v0.28.3 => k8s.io/controller-manager v0.28.3
## explicit; go 1.20
k8s.io/controller-manager/config
k8s.io/controller-manager/config/v1
@ -1450,7 +1450,7 @@ k8s.io/klog/v2/internal/clock
k8s.io/klog/v2/internal/dbg
k8s.io/klog/v2/internal/serialize
k8s.io/klog/v2/internal/severity
# k8s.io/kms v0.28.2
# k8s.io/kms v0.28.3
## explicit; go 1.20
k8s.io/kms/apis/v1beta1
k8s.io/kms/apis/v2
@ -1478,15 +1478,15 @@ k8s.io/kube-openapi/pkg/validation/errors
k8s.io/kube-openapi/pkg/validation/spec
k8s.io/kube-openapi/pkg/validation/strfmt
k8s.io/kube-openapi/pkg/validation/strfmt/bson
# k8s.io/kubectl v0.0.0 => k8s.io/kubectl v0.28.2
# k8s.io/kubectl v0.0.0 => k8s.io/kubectl v0.28.3
## explicit; go 1.20
k8s.io/kubectl/pkg/scale
k8s.io/kubectl/pkg/util/podutils
# k8s.io/kubelet v0.0.0 => k8s.io/kubelet v0.28.2
# k8s.io/kubelet v0.0.0 => k8s.io/kubelet v0.28.3
## explicit; go 1.20
k8s.io/kubelet/pkg/apis
k8s.io/kubelet/pkg/apis/stats/v1alpha1
# k8s.io/kubernetes v1.28.2
# k8s.io/kubernetes v1.28.3
## explicit; go 1.20
k8s.io/kubernetes/pkg/api/legacyscheme
k8s.io/kubernetes/pkg/api/service
@ -1549,10 +1549,10 @@ k8s.io/kubernetes/test/utils
k8s.io/kubernetes/test/utils/format
k8s.io/kubernetes/test/utils/image
k8s.io/kubernetes/test/utils/kubeconfig
# k8s.io/mount-utils v0.28.2 => k8s.io/mount-utils v0.28.2
# k8s.io/mount-utils v0.28.3 => k8s.io/mount-utils v0.28.3
## explicit; go 1.20
k8s.io/mount-utils
# k8s.io/pod-security-admission v0.0.0 => k8s.io/pod-security-admission v0.28.2
# k8s.io/pod-security-admission v0.0.0 => k8s.io/pod-security-admission v0.28.3
## explicit; go 1.20
k8s.io/pod-security-admission/api
k8s.io/pod-security-admission/policy
@ -1637,31 +1637,31 @@ sigs.k8s.io/yaml
# github.com/ceph/ceph-csi/api => ./api
# github.com/portworx/sched-ops => github.com/portworx/sched-ops v0.20.4-openstorage-rc3
# gomodules.xyz/jsonpatch/v2 => github.com/gomodules/jsonpatch/v2 v2.2.0
# k8s.io/api => k8s.io/api v0.28.2
# k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.28.2
# k8s.io/apimachinery => k8s.io/apimachinery v0.28.2
# k8s.io/apiserver => k8s.io/apiserver v0.28.2
# k8s.io/cli-runtime => k8s.io/cli-runtime v0.28.2
# k8s.io/client-go => k8s.io/client-go v0.28.2
# k8s.io/cloud-provider => k8s.io/cloud-provider v0.28.2
# k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.28.2
# k8s.io/code-generator => k8s.io/code-generator v0.28.2
# k8s.io/component-base => k8s.io/component-base v0.28.2
# k8s.io/component-helpers => k8s.io/component-helpers v0.28.2
# k8s.io/controller-manager => k8s.io/controller-manager v0.28.2
# k8s.io/cri-api => k8s.io/cri-api v0.28.2
# k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.28.2
# k8s.io/dynamic-resource-allocation => k8s.io/dynamic-resource-allocation v0.28.2
# k8s.io/endpointslice => k8s.io/endpointslice v0.28.2
# k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.28.2
# k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.28.2
# k8s.io/kube-proxy => k8s.io/kube-proxy v0.28.2
# k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.28.2
# k8s.io/kubectl => k8s.io/kubectl v0.28.2
# k8s.io/kubelet => k8s.io/kubelet v0.28.2
# k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.28.2
# k8s.io/metrics => k8s.io/metrics v0.28.2
# k8s.io/mount-utils => k8s.io/mount-utils v0.28.2
# k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.28.2
# k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.28.2
# k8s.io/api => k8s.io/api v0.28.3
# k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.28.3
# k8s.io/apimachinery => k8s.io/apimachinery v0.28.3
# k8s.io/apiserver => k8s.io/apiserver v0.28.3
# k8s.io/cli-runtime => k8s.io/cli-runtime v0.28.3
# k8s.io/client-go => k8s.io/client-go v0.28.3
# k8s.io/cloud-provider => k8s.io/cloud-provider v0.28.3
# k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.28.3
# k8s.io/code-generator => k8s.io/code-generator v0.28.3
# k8s.io/component-base => k8s.io/component-base v0.28.3
# k8s.io/component-helpers => k8s.io/component-helpers v0.28.3
# k8s.io/controller-manager => k8s.io/controller-manager v0.28.3
# k8s.io/cri-api => k8s.io/cri-api v0.28.3
# k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.28.3
# k8s.io/dynamic-resource-allocation => k8s.io/dynamic-resource-allocation v0.28.3
# k8s.io/endpointslice => k8s.io/endpointslice v0.28.3
# k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.28.3
# k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.28.3
# k8s.io/kube-proxy => k8s.io/kube-proxy v0.28.3
# k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.28.3
# k8s.io/kubectl => k8s.io/kubectl v0.28.3
# k8s.io/kubelet => k8s.io/kubelet v0.28.3
# k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.28.3
# k8s.io/metrics => k8s.io/metrics v0.28.3
# k8s.io/mount-utils => k8s.io/mount-utils v0.28.3
# k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.28.3
# k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.28.3
# layeh.com/radius => github.com/layeh/radius v0.0.0-20190322222518-890bc1058917