github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #122692 from aroradaman/reject-packets-to-invalid-port

Browse Source 
proxy/nftables: reject packets destined for invalid ports of service ips
This commit is contained in:
Kubernetes Prow Robot
2024-01-24 23:17:34 +01:00
committed by GitHub
parent 17ad610559 25a40b1c7c
commit 55f9657e07
13 changed files with 457 additions and 150 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
View File

@@ -534,6 +534,10 @@ func ClusterRoles() []rbacv1.ClusterRole {
eventsRule(),
}
if utilfeature.DefaultFeatureGate.Enabled(features.MultiCIDRServiceAllocator) {
nodeProxierRules = append(nodeProxierRules, rbacv1helpers.NewRule("list", "watch").Groups(networkingGroup).Resources("servicecidrs").RuleOrDie())
}
nodeProxierRules = append(nodeProxierRules, rbacv1helpers.NewRule("list", "watch").Groups(discoveryGroup).Resources("endpointslices").RuleOrDie())
roles = append(roles, rbacv1.ClusterRole{
ObjectMeta: metav1.ObjectMeta{Name: "system:node-proxier"},