Make UI work through kubectl proxy (again)

Fixes #10115.

pkg/kubectl/proxy_server.go

@@ -31,7 +31,7 @@ import (
 
 const (
 	DefaultHostAcceptRE   = "^localhost$,^127\\.0\\.0\\.1$,^\\[::1\\]$"
-	DefaultPathAcceptRE   = "^/api/.*"
+	DefaultPathAcceptRE   = "^/.*"
 	DefaultPathRejectRE   = "^/api/.*/exec,^/api/.*/run"
 	DefaultMethodRejectRE = "POST,PUT,PATCH"
 )
@@ -75,6 +75,7 @@ func MakeRegexpArrayOrDie(str string) []*regexp.Regexp {
 func matchesRegexp(str string, regexps []*regexp.Regexp) bool {
 	for _, re := range regexps {
 		if re.MatchString(str) {
+			glog.V(6).Infof("%v matched %s", str, re)
 			return true
 		}
 	}
@@ -83,17 +84,28 @@ func matchesRegexp(str string, regexps []*regexp.Regexp) bool {
 
 func (f *FilterServer) accept(method, path, host string) bool {
 	if matchesRegexp(path, f.RejectPaths) {
+		glog.V(3).Infof("Filter rejecting %v %v %v", method, path, host)
 		return false
 	}
 	if matchesRegexp(method, f.RejectMethods) {
+		glog.V(3).Infof("Filter rejecting %v %v %v", method, path, host)
 		return false
 	}
 	if matchesRegexp(path, f.AcceptPaths) && matchesRegexp(host, f.AcceptHosts) {
+		glog.V(3).Infof("Filter accepting %v %v %v", method, path, host)
 		return true
 	}
+	glog.V(3).Infof("Filter rejecting %v %v %v", method, path, host)
 	return false
 }
 
+// Make a copy of f which passes requests along to the new delegate.
+func (f *FilterServer) HandlerFor(delegate http.Handler) *FilterServer {
+	f2 := *f
+	f2.delegate = delegate
+	return &f2
+}
+
 func (f *FilterServer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	host, _, _ := net.SplitHostPort(req.Host)
 	if f.accept(req.Method, req.URL.Path, host) {
@@ -106,12 +118,12 @@ func (f *FilterServer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 
 // ProxyServer is a http.Handler which proxies Kubernetes APIs to remote API server.
 type ProxyServer struct {
-	mux *http.ServeMux
-	httputil.ReverseProxy
+	handler http.Handler
 }
 
 // NewProxyServer creates and installs a new ProxyServer.
 // It automatically registers the created ProxyServer to http.DefaultServeMux.
+// 'filter', if non-nil, protects requests to the api only.
 func NewProxyServer(filebase string, apiProxyPrefix string, staticPrefix string, filter *FilterServer, cfg *client.Config) (*ProxyServer, error) {
 	host := cfg.Host
 	if !strings.HasSuffix(host, "/") {
@@ -121,46 +133,45 @@ func NewProxyServer(filebase string, apiProxyPrefix string, staticPrefix string,
 	if err != nil {
 		return nil, err
 	}
-	proxy := newProxyServer(target)
+	proxy := newProxy(target)
 	if proxy.Transport, err = client.TransportFor(cfg); err != nil {
 		return nil, err
 	}
-
-	var server http.Handler
-	if strings.HasPrefix(apiProxyPrefix, "/api") {
-		server = proxy
-	} else {
-		server = http.StripPrefix(apiProxyPrefix, proxy)
-	}
+	proxyServer := http.Handler(proxy)
 	if filter != nil {
-		filter.delegate = server
-		server = filter
+		proxyServer = filter.HandlerFor(proxyServer)
 	}
 
-	proxy.mux.Handle(apiProxyPrefix, server)
-	proxy.mux.Handle(staticPrefix, newFileHandler(staticPrefix, filebase))
-	return proxy, nil
+	if !strings.HasPrefix(apiProxyPrefix, "/api") {
+		proxyServer = stripLeaveSlash(apiProxyPrefix, proxyServer)
+	}
+
+	mux := http.NewServeMux()
+	mux.Handle(apiProxyPrefix, proxyServer)
+	if filebase != "" {
+		// Require user to explicitly request this behavior rather than
+		// serving their working directory by default.
+		mux.Handle(staticPrefix, newFileHandler(staticPrefix, filebase))
+	}
+	return &ProxyServer{handler: mux}, nil
 }
 
 // Serve starts the server (http.DefaultServeMux) on given port, loops forever.
 func (s *ProxyServer) Serve(port int) error {
 	server := http.Server{
 		Addr:    fmt.Sprintf(":%d", port),
-		Handler: s.mux,
+		Handler: s.handler,
 	}
 	return server.ListenAndServe()
 }
 
-func newProxyServer(target *url.URL) *ProxyServer {
+func newProxy(target *url.URL) *httputil.ReverseProxy {
 	director := func(req *http.Request) {
 		req.URL.Scheme = target.Scheme
 		req.URL.Host = target.Host
 		req.URL.Path = singleJoiningSlash(target.Path, req.URL.Path)
 	}
-	return &ProxyServer{
-		ReverseProxy: httputil.ReverseProxy{Director: director},
-		mux:          http.NewServeMux(),
-	}
+	return &httputil.ReverseProxy{Director: director}
 }
 
 func newFileHandler(prefix, base string) http.Handler {
@@ -178,3 +189,20 @@ func singleJoiningSlash(a, b string) string {
 	}
 	return a + b
 }
+
+// like http.StripPrefix, but always leaves an initial slash. (so that our
+// regexps will work.)
+func stripLeaveSlash(prefix string, h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		p := strings.TrimPrefix(req.URL.Path, prefix)
+		if len(p) >= len(req.URL.Path) {
+			http.NotFound(w, req)
+			return
+		}
+		if len(p) > 0 && p[:1] != "/" {
+			p = "/" + p
+		}
+		req.URL.Path = p
+		h.ServeHTTP(w, req)
+	})
+}