Repository navigation
fix(apiserver): keep the unauthenticated plain listener on loopback - #215
Open
Andrei Kvapil (kvaps) wants to merge 1 commit into
Open
Andrei Kvapil (kvaps) wants to merge 1 commit into
Andrei Kvapil (kvaps) wants to merge 1 commit into
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
The plain-HTTP listener serves the whole API without a client certificate. It bound every pod interface by default, so any pod that could reach the apiserver pod IP had full read-write access; only its absence from the Service kept it off the cluster network, and nothing enforced that. The default is now 127.0.0.1:3370, in the apiserver and in the controller's legacy REST mode, and the stand manifest passes the same. kubectl port-forward still reaches it, since it connects inside the pod's network namespace. Tests pin the default and the manifest value to a loopback address. Fixes #201 Assisted-by: LLM Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Andrei Kvapil (kvaps)
force-pushed
the
fix/apiserver-plain-localhost
branch
from
October 24, 2026 21:53
59f380c to
388cb02
Compare
Andrei Kvapil (kvaps)
marked this pull request as ready for review
October 24, 2026 22:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The apiserver's plain-HTTP listener serves the whole LINSTOR API with no client certificate, and it bound every pod interface by default. Only its absence from the Service kept it off the cluster network, and nothing enforced that: any pod that could reach an apiserver pod IP had full read-write access.
The listener now defaults to
127.0.0.1:3370, in the apiserver and in the controller's single-binary REST mode, and the stand manifest passes the same and no longer declares the container port.kubectl port-forwardkeeps working, since it connects inside the pod's network namespace. Every in-repo client of the plain port already goes through a port-forward; CSI and piraeus use the mutual-TLS port.The controller's single-binary REST mode (
--enable-rest-api=true) has no TLS listener, so with the new default it has no network endpoint at all: in-cluster clients get connection refused. Nothing deployed runs that mode;--rest-bind-address=:3370brings the old behaviour back, exposure included.Stacked on #190.
Fixes #201
Testing
:3370reddens a test.go test ./...: green apart from the knownserver did not stop within 2s after cancelflake inpkg/rest.