github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

kubectl: Add proxy --unix-socket=/file/path option

Browse Source 
Proxies on a TCP port are accessible outside the current security
context (eg: uid). Add support for having the proxy listen on a
unix socket, which has permissions applied to it.

We make sure the socket starts its life only accessible by the
current user using Umask.

This is useful for applications like Cockpit and other tools which
want the help of kubectl to handle authentication, configuration and
transport security, but also want to not make that accessible to
all users on a multi-user system.
This commit is contained in:
Stef Walter
2015-07-01 10:17:53 +02:00
parent cd30bd6167
commit f6da3fdbe1
6 changed files with 53 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/user-guide/kubectl/kubectl_proxy.md
View File

@@ -80,11 +80,12 @@ $ kubectl proxy --api-prefix=/k8s-api
--accept-hosts="^localhost$,^127\\.0\\.0\\.1$,^\\[::1\\]$": Regular expression for hosts that the proxy should accept.
--accept-paths="^/.*": Regular expression for paths that the proxy should accept.
--api-prefix="/api/": Prefix to serve the proxied API under.
--disable-filter=false: If true, disable request filtering in the proxy. This is dangerous, and can leave you vulnerable to XSRF attacks. Use with caution.
--disable-filter=false: If true, disable request filtering in the proxy. This is dangerous, and can leave you vulnerable to XSRF attacks, when used with an accessible port.
-h, --help=false: help for proxy
-p, --port=8001: The port on which to run the proxy. Set to 0 to pick a random port.
--reject-methods="POST,PUT,PATCH": Regular expression for HTTP methods that the proxy should reject.
--reject-paths="^/api/.*/exec,^/api/.*/run": Regular expression for paths that the proxy should reject.
-u, --unix-socket="": Unix socket on which to run the proxy.
-w, --www="": Also serve static files from the given directory under the specified prefix.
-P, --www-prefix="/static/": Prefix to serve static files under, if static file directory is specified.
```
@@ -122,7 +123,7 @@ $ kubectl proxy --api-prefix=/k8s-api
* [kubectl](kubectl.md) - kubectl controls the Kubernetes cluster manager
###### Auto generated by spf13/cobra at 2015-07-14 00:11:42.957150329 +0000 UTC
###### Auto generated by spf13/cobra at 2015-08-04 15:27:44.354669483 +0000 UTC
<!-- BEGIN MUNGE: GENERATED_ANALYTICS -->