kubernetes / kubernetes/kubectl
kubectl proxy when you request an api that requires http Authorization header authentication, it will not process the response correctly
- Dominant language
- Go
- Stars
- 3.3k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
kube-apiServer handles authentication using Authorization headers,whether there is a conflict with my service's use of Authorization headers to handle authentication?
The following is the request message:
GET /api/v1/namespaces/default/services/ddr-api:http-port/proxy/api/v1/group HTTP/1.1
> Host: localhost:8001
> Accept-Encoding: deflate, gzip, br, zstd
> Accept: application/json, text/plain, */*
> Accept-Language: zh-CN,zh-HK;q=0.9,zh;q=0.8,en;q=0.7,en-US;q=0.6
> Authorization: Basic YWRtaW46YWRtaW4=
> Cache-Control: no-cache
> Connection: keep-alive
> Content-Type: application/json
> Cookie: curpage=1; hasplmlang=_int_; Synyi.AuditLog.TraceId=4b4a77825a214192b2e076c20261ab7e
> DNT: 1
> Pragma: no-cache
> Referer: http://localhost:8001/api/v1/namespaces/default/services/ddr-api:http-port/proxy/logs
> Sec-Fetch-Dest: empty
> Sec-Fetch-Mode: cors
> Sec-Fetch-Site: same-origin
> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
> sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108", "Google Chrome";v="108"
> sec-ch-ua-mobile: ?0
> sec-ch-ua-platform: "Windows"
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 401 Unauthorized
< Cache-Control: no-cache, private
< Content-Length: 21
< Content-Type: text/plain; charset=utf-8
< Date: Tue, 10 Jan 2023 10:44:22 GMT
< Server: nginx
<
{ [21 bytes data]
100 21 100 21 0 0 564 0 --:--:-- --:--:-- --:--:-- 677HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, private
Content-Length: 21
Content-Type: text/plain; charset=utf-8
Date: Tue, 10 Jan 2023 10:44:22 GMT
Server: nginx
Contributor guide
Research direction
Start by reproducing the request through kubectl proxy at the service proxy endpoint, using the shown Authorization header and checking the 401 response and returned headers. Review the proxy's request and response handling to determine whether the upstream service's authentication is being altered; completion requires an agreed expected behavior and a reproduction test showing it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100