kubernetes / kubernetes/kubectl

kubectl proxy when you request an api that requires http Authorization header authentication, it will not process the response correctly

Open
#1,348 9 comments 1 reaction 0 assignees View on GitHub
kind/bug lifecycle/rotten needs-triage triage/needs-information
Dominant language
Go
Stars
3.3k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

kube-apiServer handles authentication using Authorization headers,whether there is a conflict with my service's use of Authorization headers to handle authentication?
The following is the request message:
GET /api/v1/namespaces/default/services/ddr-api:http-port/proxy/api/v1/group HTTP/1.1
> Host: localhost:8001
> Accept-Encoding: deflate, gzip, br, zstd
> Accept: application/json, text/plain, */*
> Accept-Language: zh-CN,zh-HK;q=0.9,zh;q=0.8,en;q=0.7,en-US;q=0.6
> Authorization: Basic YWRtaW46YWRtaW4=
> Cache-Control: no-cache
> Connection: keep-alive
> Content-Type: application/json
> Cookie: curpage=1; hasplmlang=_int_; Synyi.AuditLog.TraceId=4b4a77825a214192b2e076c20261ab7e
> DNT: 1
> Pragma: no-cache
> Referer: http://localhost:8001/api/v1/namespaces/default/services/ddr-api:http-port/proxy/logs
> Sec-Fetch-Dest: empty
> Sec-Fetch-Mode: cors
> Sec-Fetch-Site: same-origin
> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
> sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108", "Google Chrome";v="108"
> sec-ch-ua-mobile: ?0
> sec-ch-ua-platform: "Windows"
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 401 Unauthorized
< Cache-Control: no-cache, private
< Content-Length: 21
< Content-Type: text/plain; charset=utf-8
< Date: Tue, 10 Jan 2023 10:44:22 GMT
< Server: nginx
<
{ [21 bytes data]
100 21 100 21 0 0 564 0 --:--:-- --:--:-- --:--:-- 677HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, private
Content-Length: 21
Content-Type: text/plain; charset=utf-8
Date: Tue, 10 Jan 2023 10:44:22 GMT
Server: nginx

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the request through kubectl proxy at the service proxy endpoint, using the shown Authorization header and checking the 401 response and returned headers. Review the proxy's request and response handling to determine whether the upstream service's authentication is being altered; completion requires an agreed expected behavior and a reproduction test showing it.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.