Kubernetes Submit Queue 4ac5f278c5 Merge pull request #38742 from timstclair/cri-exec-long ...

Automatic merge from submit-queue

[CRI] Don't include user data in CRI streaming redirect URLs

Fixes: https://github.com/kubernetes/kubernetes/issues/36187

Avoid userdata in the redirect URLs by caching the {Exec,Attach,PortForward}Requests with a unique token. When the redirect URL is created, the token is substituted for the request params. When the streaming server receives the token request, the token is used to fetch the actual request parameters out of the cache.

For additional security, the token is generated using the secure random function, is single use (i.e. the first request with the token consumes it), and has a short expiration time.

/cc @kubernetes/sig-node

2017-01-11 17:16:07 -08:00

..

portforward

start the apimachinery repo

2017-01-11 09:09:48 -05:00

remotecommand

mechanical repercussions

2017-01-11 15:20:36 -05:00

stats

start the apimachinery repo

2017-01-11 09:09:48 -05:00

streaming

Don't include user data in CRI streaming redirect URLs

2017-01-11 13:40:43 -08:00

auth_test.go

Wire kubelet authn/authz

2016-10-25 03:40:09 -04:00

auth.go

start the apimachinery repo

2017-01-11 09:09:48 -05:00

BUILD

mechanical repercussions

2017-01-11 15:20:36 -05:00

doc.go

Use Go canonical import paths

2016-07-16 13:48:21 -04:00

server_test.go

start the apimachinery repo

2017-01-11 09:09:48 -05:00

server.go

Merge pull request #38742 from timstclair/cri-exec-long

2017-01-11 17:16:07 -08:00