Use internal address for admin API when appropriate #125
Conversation
If SVC.enabled=false, do not render ports for that service in the deployment template.
Use 127.0.0.1 as the admin listen address if the admin service is disabled. This is primarily for controller-managed deployments, where the admin API should not be exposed outside the pod (removing it from the deployment ports alone does not prevent this). This changes adds generic support for specifying the listen address, but does not use local listens for other services: generally, the admin API is the only service we expect to encounter a disabled service with enabled listens.
There was a problem hiding this comment.
I'm a little concerned about disabling exposing ports when there are no k8s service for a component (manager, portal etc). Could there be a case where someone doesn't want a k8s service but wants to expose the ports? While technically possible, the likelihood is extremely low given how these components interact.
Nice work with the patch and also the PR description. The description very clear and helped so much in understanding the changes.
|
Hard to say. Per https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#container-v1-core this is informational, and by that token they probably should be declared if the listen exists. The ports are always exposed if the listen exists, and removing this just kinda pretends they aren't. That said, I have limited practical concerns about it:
|
Use 127.0.0.1 as the admin listen address if the admin service is disabled. This is primarily for controller-managed deployments, where the admin API should not be exposed outside the pod (removing it from the deployment ports alone does not prevent this). This changes adds generic support for specifying the listen address, but does not use local listens for other services: generally, the admin API is the only service we expect to encounter a disabled service with enabled listens. If SVC.enabled=false, do not render ports for that service in the deployment template.
What this PR does / why we need it:
If the admin service is disabled, but the admin listens are enabled (i.e. the configuration we expect for controller-managed instances), use
127.0.0.1for the admin listen address to prevent access from outside the pod.Additionally:
Checklist
[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]
nextbranch and targetsnext, notmaster[kong])