Skip to content

Commit 3f7e6a3

Browse files
brandondbrandond
committed
Move delegating auth middleware into common package and add MaxInFlight
Adds maximum in-flight request limits to agent join and p2p peer info request request handlers. Signed-off-by: Brad Davidson <[email protected]>
1 parent 7883918 commit 3f7e6a3

File tree

8 files changed

+121
-109
lines changed

8 files changed

+121
-109
lines changed

‎go.mod

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -128,11 +128,11 @@ require (
128128
github.com/prometheus/client_golang v1.21.1
129129
github.com/prometheus/common v0.62.0
130130
github.com/rancher/dynamiclistener v0.6.0-rc1
131-
github.com/rancher/lasso v0.0.0-20250109193533-00757eec2dbd
131+
github.com/rancher/lasso v0.2.1
132132
github.com/rancher/permissions v0.0.0-20240523180510-4001d3d637f7
133133
github.com/rancher/remotedialer v0.4.1
134134
github.com/rancher/wharfie v0.6.9
135-
github.com/rancher/wrangler/v3 v3.2.0-rc.1
135+
github.com/rancher/wrangler/v3 v3.2.1-0.20250404112553-6674f9c57bfe
136136
github.com/robfig/cron/v3 v3.0.1
137137
github.com/rootless-containers/rootlesskit v1.1.1
138138
github.com/sirupsen/logrus v1.9.3
@@ -150,7 +150,7 @@ require (
150150
go.uber.org/mock v0.5.0
151151
go.uber.org/zap v1.27.0
152152
golang.org/x/crypto v0.37.0
153-
golang.org/x/mod v0.22.0
153+
golang.org/x/mod v0.23.0
154154
golang.org/x/net v0.39.0
155155
golang.org/x/sync v0.13.0
156156
golang.org/x/sys v0.32.0
@@ -257,7 +257,7 @@ require (
257257
github.com/emicklei/go-restful v2.16.0+incompatible // indirect
258258
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
259259
github.com/euank/go-kmsg-parser v2.0.0+incompatible // indirect
260-
github.com/evanphx/json-patch v5.9.0+incompatible // indirect
260+
github.com/evanphx/json-patch v5.9.11+incompatible // indirect
261261
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
262262
github.com/fatih/camelcase v1.0.0 // indirect
263263
github.com/felixge/httpsnoop v1.0.4 // indirect
@@ -322,7 +322,6 @@ require (
322322
github.com/karrick/godirwalk v1.17.0 // indirect
323323
github.com/klauspost/cpuid/v2 v2.2.9 // indirect
324324
github.com/koron/go-ssdp v0.0.4 // indirect
325-
github.com/kylelemons/godebug v1.1.0 // indirect
326325
github.com/libopenstorage/openstorage v1.0.0 // indirect
327326
github.com/libp2p/go-buffer-pool v0.1.0 // indirect
328327
github.com/libp2p/go-cidranger v1.1.0 // indirect
@@ -473,7 +472,7 @@ require (
473472
golang.org/x/term v0.30.0 // indirect
474473
golang.org/x/text v0.23.0 // indirect
475474
golang.org/x/time v0.10.0 // indirect
476-
golang.org/x/tools v0.28.0 // indirect
475+
golang.org/x/tools v0.30.0 // indirect
477476
golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 // indirect
478477
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 // indirect
479478
gonum.org/v1/gonum v0.15.0 // indirect

‎go.sum

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -454,8 +454,8 @@ github.com/erikdubbelboer/gspt v0.0.0-20190125194910-e68493906b83 h1:ngHdSomn2My
454454
github.com/erikdubbelboer/gspt v0.0.0-20190125194910-e68493906b83/go.mod h1:v6o7m/E9bfvm79dE1iFiF+3T7zLBnrjYjkWMa1J+Hv0=
455455
github.com/euank/go-kmsg-parser v2.0.0+incompatible h1:cHD53+PLQuuQyLZeriD1V/esuG4MuU0Pjs5y6iknohY=
456456
github.com/euank/go-kmsg-parser v2.0.0+incompatible/go.mod h1:MhmAMZ8V4CYH4ybgdRwPr2TU5ThnS43puaKEMpja1uw=
457-
github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lShz4oaXpDTX2bLe7ls=
458-
github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
457+
github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb4Z+d1UQi45df52xW8=
458+
github.com/evanphx/json-patch v5.9.11+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
459459
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4=
460460
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
461461
github.com/fatih/camelcase v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8=
@@ -1204,16 +1204,16 @@ github.com/quic-go/webtransport-go v0.8.1-0.20241018022711-4ac2c9250e66 h1:4WFk6
12041204
github.com/quic-go/webtransport-go v0.8.1-0.20241018022711-4ac2c9250e66/go.mod h1:Vp72IJajgeOL6ddqrAhmp7IM9zbTcgkQxD/YdxrVwMw=
12051205
github.com/rancher/dynamiclistener v0.6.0-rc1 h1:Emwf9o7PMLdQNv4lvFx7xJKxDuDa4Y69GvVEGU9U9Js=
12061206
github.com/rancher/dynamiclistener v0.6.0-rc1/go.mod h1:BIPgJ8xFSUyuTyGvRMVt++S1qjD3+7Ptvq1TXl6hcTM=
1207-
github.com/rancher/lasso v0.0.0-20250109193533-00757eec2dbd h1:W4hWtKB8A2SSJlxkphvzwA+RkiOrgHg9Gytc78S0pvk=
1208-
github.com/rancher/lasso v0.0.0-20250109193533-00757eec2dbd/go.mod h1:IxgTBO55lziYhTEETyVKiT8/B5Rg92qYiRmcIIYoPgI=
1207+
github.com/rancher/lasso v0.2.1 h1:SZTqMVQn8cAOqvwGBd1/EYOIJ/MGN+UfJrOWvHd4jHU=
1208+
github.com/rancher/lasso v0.2.1/go.mod h1:KSV3jBXfdXqdCuMm2uC8kKB9q/wuDYb3h0eHZoRjShM=
12091209
github.com/rancher/permissions v0.0.0-20240523180510-4001d3d637f7 h1:0Kg2SGoMeU1ll4xPi4DE0+qNHLFO/U5MwtK0WrIdK+o=
12101210
github.com/rancher/permissions v0.0.0-20240523180510-4001d3d637f7/go.mod h1:fsbs0YOsGn1ofPD5p+BuI4qDhbMbSJtTegKt6Ucna+c=
12111211
github.com/rancher/remotedialer v0.4.1 h1:jwOf2kPRjBBpSFofv1OuZHWaYHeC9Eb6/XgDvbkoTgc=
12121212
github.com/rancher/remotedialer v0.4.1/go.mod h1:Ys004RpJuTLSm+k4aYUCoFiOOad37ubYev3TkOFg/5w=
12131213
github.com/rancher/wharfie v0.6.9 h1:w0xf8F/LqjuXBYYJRMWTcHWIF8p4zVKmFOOEqz74VhQ=
12141214
github.com/rancher/wharfie v0.6.9/go.mod h1:PpyuDiBgnFVd56kKtNfSS3cMDTVcRJZVYfNwxcqv50I=
1215-
github.com/rancher/wrangler/v3 v3.2.0-rc.1 h1:c0r5aBVUwWUqfeVFP9S4JGalsLra5zHZtvyteSuKHtI=
1216-
github.com/rancher/wrangler/v3 v3.2.0-rc.1/go.mod h1:8DV2nXOOiUrsoRviL3WmzjELR5B6AS8CtMGEP34E0DE=
1215+
github.com/rancher/wrangler/v3 v3.2.1-0.20250404112553-6674f9c57bfe h1:sRkWWOzFJFkoqWknniWes0S9KpYLHOUqBdzPpIpWipM=
1216+
github.com/rancher/wrangler/v3 v3.2.1-0.20250404112553-6674f9c57bfe/go.mod h1:0C5QyvSrQOff8gQQzpB/L/FF03EQycjR3unSJcKCHno=
12171217
github.com/raulk/go-watchdog v1.3.0 h1:oUmdlHxdkXRJlwfG0O9omj8ukerm8MEQavSiDTEtBsk=
12181218
github.com/raulk/go-watchdog v1.3.0/go.mod h1:fIvOnLbF0b0ZwkB9YU4mOW9Did//4vPZtDqv66NfsMU=
12191219
github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
@@ -1508,8 +1508,8 @@ golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
15081508
golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
15091509
golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
15101510
golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
1511-
golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
1512-
golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
1511+
golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM=
1512+
golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
15131513
golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
15141514
golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
15151515
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -1678,8 +1678,8 @@ golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
16781678
golang.org/x/tools v0.10.0/go.mod h1:UJwyiVBsOA2uwvK/e5OY3GTpDUJriEd+/YlqAwLPmyM=
16791679
golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
16801680
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
1681-
golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8=
1682-
golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
1681+
golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY=
1682+
golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY=
16831683
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
16841684
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
16851685
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

‎pkg/agent/https/https.go

Lines changed: 3 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,13 @@ package https
22

33
import (
44
"context"
5-
"net/http"
65
"strconv"
76
"sync"
87

98
"github.com/gorilla/mux"
109
"github.com/k3s-io/k3s/pkg/daemons/config"
11-
"github.com/k3s-io/api/pkg/generated/clientset/versioned/scheme"
10+
"github.com/k3s-io/k3s/pkg/server/auth"
1211
"github.com/k3s-io/k3s/pkg/util"
13-
"github.com/k3s-io/k3s/pkg/version"
14-
"k8s.io/apiserver/pkg/apis/apiserver"
15-
"k8s.io/apiserver/pkg/authentication/authenticator"
16-
"k8s.io/apiserver/pkg/authorization/authorizer"
17-
genericapifilters "k8s.io/apiserver/pkg/endpoints/filters"
18-
apirequest "k8s.io/apiserver/pkg/endpoints/request"
1912
"k8s.io/apiserver/pkg/server"
2013
"k8s.io/apiserver/pkg/server/options"
2114
)
@@ -33,7 +26,7 @@ var err error
3326
func Start(ctx context.Context, nodeConfig *config.Node, runtime *config.ControlRuntime) (*mux.Router, error) {
3427
once.Do(func() {
3528
router = mux.NewRouter().SkipClean(true)
36-
config := server.Config{}
29+
config := &server.Config{}
3730

3831
if runtime == nil {
3932
// If we do not have an existing handler, set up a new listener
@@ -63,33 +56,7 @@ func Start(ctx context.Context, nodeConfig *config.Node, runtime *config.Control
6356
runtime.Handler = router
6457
}
6558

66-
authn := options.NewDelegatingAuthenticationOptions()
67-
authn.Anonymous = &apiserver.AnonymousAuthConfig{
68-
Enabled: false,
69-
}
70-
authn.SkipInClusterLookup = true
71-
authn.ClientCert = options.ClientCertAuthenticationOptions{
72-
ClientCA: nodeConfig.AgentConfig.ClientCA,
73-
}
74-
authn.RemoteKubeConfigFile = nodeConfig.AgentConfig.KubeConfigKubelet
75-
if applyErr := authn.ApplyTo(&config.Authentication, config.SecureServing, nil); applyErr != nil {
76-
err = applyErr
77-
return
78-
}
79-
80-
authz := options.NewDelegatingAuthorizationOptions()
81-
authz.AlwaysAllowPaths = []string{ // skip authz for paths that should not use SubjectAccessReview; basically everything that will use this router other than metrics
82-
"/v1-" + version.Program + "/p2p", // spegel libp2p peer discovery
83-
"/v2/*", // spegel registry mirror
84-
"/debug/pprof/*", // profiling
85-
}
86-
authz.RemoteKubeConfigFile = nodeConfig.AgentConfig.KubeConfigKubelet
87-
if applyErr := authz.ApplyTo(&config.Authorization); applyErr != nil {
88-
err = applyErr
89-
return
90-
}
91-
92-
router.Use(filterChain(config.Authentication.Authenticator, config.Authorization.Authorizer))
59+
router.Use(auth.Delegated(nodeConfig.AgentConfig.ClientCA, nodeConfig.AgentConfig.KubeConfigKubelet, config))
9360

9461
if config.SecureServing != nil {
9562
_, _, err = config.SecureServing.Serve(router, 0, ctx.Done())
@@ -98,16 +65,3 @@ func Start(ctx context.Context, nodeConfig *config.Node, runtime *config.Control
9865

9966
return router, err
10067
}
101-
102-
// filterChain runs the kubernetes authn/authz filter chain using the mux middleware API
103-
func filterChain(authn authenticator.Request, authz authorizer.Authorizer) mux.MiddlewareFunc {
104-
return func(handler http.Handler) http.Handler {
105-
requestInfoResolver := &apirequest.RequestInfoFactory{}
106-
failedHandler := genericapifilters.Unauthorized(scheme.Codecs)
107-
handler = genericapifilters.WithAuthorization(handler, authz, scheme.Codecs)
108-
handler = genericapifilters.WithAuthentication(handler, authn, failedHandler, nil, nil)
109-
handler = genericapifilters.WithRequestInfo(handler, requestInfoResolver)
110-
handler = genericapifilters.WithCacheControl(handler)
111-
return handler
112-
}
113-
}

‎pkg/cluster/https.go

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"context"
55
"crypto/tls"
66
"errors"
7+
"fmt"
78
"io"
89
"log"
910
"net"
@@ -90,27 +91,37 @@ func (c *Cluster) filterCN(cn ...string) []string {
9091
// initClusterAndHTTPS sets up the dynamic tls listener, request router,
9192
// and cluster database. Once the database is up, it starts the supervisor http server.
9293
func (c *Cluster) initClusterAndHTTPS(ctx context.Context) error {
93-
// Set up dynamiclistener TLS listener and request handler
94-
listener, handler, err := c.newListener(ctx)
94+
// Set up dynamiclistener TLS listener and request handler.
95+
// The dynamiclistener request handler is always called first as a middleware to add TLS SANs for host headers.
96+
// It does not actually do any request handling or send a response.
97+
listener, certHandler, err := c.newListener(ctx)
9598
if err != nil {
9699
return err
97100
}
98101

99-
// Get the base request handler
100-
handler, err = c.getHandler(handler)
101-
if err != nil {
102-
return err
103-
}
102+
// Create a stub request handler that returns a Service Unavailable response
103+
// if the core request handlers have not yet been started yet.
104+
var handler http.Handler = http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
105+
if c.config.Runtime.Handler != nil {
106+
c.config.Runtime.Handler.ServeHTTP(rw, req)
107+
} else {
108+
util.SendError(fmt.Errorf("starting"), rw, req, http.StatusServiceUnavailable)
109+
}
110+
})
104111

105-
// Register database request handlers and controller callbacks
112+
// Register database request handlers and controller callbacks.
113+
// The database handler wraps the stub handler, and calls it for any requests not related to database bootstrapping.
106114
handler, err = c.registerDBHandlers(handler)
107115
if err != nil {
108116
return err
109117
}
110118

111119
// Create a HTTP server with the registered request handlers, using logrus for logging
112120
server := http.Server{
113-
Handler: handler,
121+
Handler: http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
122+
certHandler.ServeHTTP(rw, req)
123+
handler.ServeHTTP(rw, req)
124+
}),
114125
}
115126

116127
if logrus.IsLevelEnabled(logrus.DebugLevel) {

‎pkg/cluster/router.go

Lines changed: 0 additions & 31 deletions
This file was deleted.

‎pkg/server/auth/auth.go

Lines changed: 65 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,20 @@ import (
88
"github.com/gorilla/mux"
99
"github.com/k3s-io/k3s/pkg/daemons/config"
1010
"github.com/k3s-io/k3s/pkg/util"
11+
"github.com/k3s-io/k3s/pkg/version"
1112
"github.com/sirupsen/logrus"
12-
"k8s.io/apiserver/pkg/endpoints/request"
13+
"k8s.io/apiserver/pkg/apis/apiserver"
14+
genericapifilters "k8s.io/apiserver/pkg/endpoints/filters"
15+
apirequest "k8s.io/apiserver/pkg/endpoints/request"
16+
"k8s.io/apiserver/pkg/server"
17+
genericfilters "k8s.io/apiserver/pkg/server/filters"
18+
"k8s.io/apiserver/pkg/server/options"
19+
"k8s.io/client-go/kubernetes/scheme"
20+
)
21+
22+
var (
23+
requestInfoResolver = &apirequest.RequestInfoFactory{}
24+
failedHandler = genericapifilters.Unauthorized(scheme.Codecs)
1325
)
1426

1527
func hasRole(mustRoles []string, roles []string) bool {
@@ -48,7 +60,7 @@ func doAuth(roles []string, serverConfig *config.Control, next http.Handler, rw
4860
return
4961
}
5062

51-
ctx := request.WithUser(req.Context(), resp.User)
63+
ctx := apirequest.WithUser(req.Context(), resp.User)
5264
req = req.WithContext(ctx)
5365
next.ServeHTTP(rw, req)
5466
}
@@ -77,3 +89,54 @@ func IsLocalOrHasRole(serverConfig *config.Control, roles ...string) mux.Middlew
7789
})
7890
}
7991
}
92+
93+
// Delegated returns a middleware function that uses core Kubernetes
94+
// authentication/authorization via client certificate auth and the SubjectAccessReview API
95+
func Delegated(clientCA, kubeConfig string, config *server.Config) mux.MiddlewareFunc {
96+
if config == nil {
97+
config = &server.Config{}
98+
}
99+
100+
authn := options.NewDelegatingAuthenticationOptions()
101+
authn.Anonymous = &apiserver.AnonymousAuthConfig{
102+
Enabled: false,
103+
}
104+
authn.SkipInClusterLookup = true
105+
authn.ClientCert = options.ClientCertAuthenticationOptions{
106+
ClientCA: clientCA,
107+
}
108+
authn.RemoteKubeConfigFile = kubeConfig
109+
if err := authn.ApplyTo(&config.Authentication, config.SecureServing, nil); err != nil {
110+
logrus.Fatalf("Failed to apply authentication configuration: %v", err)
111+
}
112+
113+
authz := options.NewDelegatingAuthorizationOptions()
114+
authz.AlwaysAllowPaths = []string{ // skip authz for paths that should not use SubjectAccessReview; basically everything that will use this router other than metrics
115+
"/v1-" + version.Program + "/p2p", // spegel libp2p peer discovery
116+
"/v2/*", // spegel registry mirror
117+
"/debug/pprof/*", // profiling
118+
}
119+
authz.RemoteKubeConfigFile = kubeConfig
120+
if err := authz.ApplyTo(&config.Authorization); err != nil {
121+
logrus.Fatalf("Failed to apply authorization configuration: %v", err)
122+
}
123+
124+
return func(handler http.Handler) http.Handler {
125+
handler = genericapifilters.WithAuthorization(handler, config.Authorization.Authorizer, scheme.Codecs)
126+
handler = genericapifilters.WithAuthentication(handler, config.Authentication.Authenticator, failedHandler, nil, nil)
127+
handler = genericapifilters.WithRequestInfo(handler, requestInfoResolver)
128+
handler = genericapifilters.WithCacheControl(handler)
129+
return handler
130+
}
131+
}
132+
133+
// MaxInFlight returns a middleware function that limits the number of requests that are executed concurrently.
134+
// This is not strictly auth related, but it also uses the core Kubernetes request filters.
135+
func MaxInFlight(nonMutatingLimit, mutatingLimit int) mux.MiddlewareFunc {
136+
return func(handler http.Handler) http.Handler {
137+
handler = genericfilters.WithMaxInFlightLimit(handler, nonMutatingLimit, mutatingLimit, nil)
138+
handler = genericapifilters.WithRequestInfo(handler, requestInfoResolver)
139+
handler = genericapifilters.WithCacheControl(handler)
140+
return handler
141+
}
142+
}

‎pkg/server/handlers/router.go

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,21 @@ const (
1919
staticURL = "/static/"
2020
)
2121

22+
var (
23+
// When starting, each agent sequentially makes requests for certs, config, and apiservers, and will poll the readyz endpoint
24+
// before starting kube-proxy. These limits effectively cap the number of agents that can join simultaneously.
25+
// Agents will automatically retry with jitter when rate-limited.
26+
maxNonMutatingAgentRequests = 20 // max concurrent get/list/watch requests
27+
maxMutatingAgentRequests = 10 // max concurrent other requests; cert generation with client-provided private key uses post.
28+
)
29+
2230
func NewHandler(ctx context.Context, control *config.Control, cfg *cmds.Server) http.Handler {
2331
nodeAuth := nodepassword.GetNodeAuthValidator(ctx, control)
2432

2533
prefix := "/v1-{program}"
2634
authed := mux.NewRouter().SkipClean(true)
2735
authed.NotFoundHandler = APIServer(control, cfg)
28-
authed.Use(auth.HasRole(control, version.Program+":agent", user.NodesGroup, bootstrapapi.BootstrapDefaultGroup))
36+
authed.Use(auth.HasRole(control, version.Program+":agent", user.NodesGroup, bootstrapapi.BootstrapDefaultGroup), auth.MaxInFlight(maxNonMutatingAgentRequests, maxMutatingAgentRequests))
2937
authed.Handle(prefix+"/serving-kubelet.crt", ServingKubeletCert(control, nodeAuth))
3038
authed.Handle(prefix+"/client-kubelet.crt", ClientKubeletCert(control, nodeAuth))
3139
authed.Handle(prefix+"/client-kube-proxy.crt", ClientKubeProxyCert(control))

0 commit comments

Comments
 (0)