Add an ssh tunnel option to the /proxy endpoint #9292
Conversation
cjcullen
force-pushed
the
test_pull_8946
branch
3 times, most recently
from
58e01a8 to
0a20dbe
Compare
|
EXPERIMENTAL JENKINS PR BUILDER: e2e build succeeded. |
|
This is a lot of new code. What issue does it address? Is it v1.0? |
ghost
self-assigned this
|
I think part of #3168 ? |
|
This addresses #3168 for the /proxy case (we won't need kubelet listening on the public internet for proxy). |
| return nil | ||
| } | ||
|
|
||
| func (l SSHTunnelList) Close() { |
There was a problem hiding this comment.
Document that this is async, and tunnels won't be closed when the method returns.
|
Generally LGTM, needs a rebase (and tests, if you felt like writing them...) |
…controllermanager.
Trim space on ssh key so GCE doesn't treat it as 2 lines. A couple other minor fixes.
Refactor loadTunnels to allow one path for load, another for refresh. Make SSHTunnelList.Close sleep for a minute before actually closing each tunnel.
Add NetworkName to gce.Config. Add locking to uses of master.tunnels.
|
EXPERIMENTAL JENKINS PR BUILDER: e2e build succeeded. |
…rade/reboot). Add comment describing what SSHTunnelList.Close() does. Simplify util.FileExists.
|
EXPERIMENTAL JENKINS PR BUILDER: e2e build succeeded. |
1 similar comment
|
EXPERIMENTAL JENKINS PR BUILDER: e2e build succeeded. |
…window where closed tunnels from scaling down may exist).
|
EXPERIMENTAL JENKINS PR BUILDER: e2e build succeeded. |
|
Mostly LGTM, a couple of nits. |
|
Note: this is not enabled by default. On GCE, it will only be enabled if grains.proxy_ssh_user is set. |
brendandburns
added
the
lgtm
|
@cjcullen and @brendanburns are working on the missing tests, which can come in a separate PR. This PR LGTM. |
Add an ssh tunnel option to the /proxy endpoint
This change is required for the handler to work with sshtunnels. Without it, `kubectl exec` and `kubectl port-forward` are broken when an ssh proxy is used (see kubernetes#9292). I manually verified this fixes that issue, e2e test coming shortly.
Key generation and propagation is handled on gce.
Tunnels are recycled after 5 minutes.
The ssh-proxy functionality is not enabled by default for the gce provider.
I can squash commits when this gets ready to merge.
@brendandburns