forked from k3s-io/k3s
-
Notifications
You must be signed in to change notification settings - Fork 0
/
tunnel.go
50 lines (42 loc) · 1.16 KB
/
tunnel.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
package control
import (
"context"
"net"
"net/http"
"time"
"github.com/rancher/norman/pkg/kv"
"github.com/rancher/norman/pkg/remotedialer"
utilnet "k8s.io/apimachinery/pkg/util/net"
"k8s.io/apiserver/pkg/endpoints/request"
"k8s.io/kubernetes/cmd/kube-apiserver/app"
)
func setupTunnel() http.Handler {
tunnelServer := remotedialer.New(authorizer, remotedialer.DefaultErrorWriter)
setupProxyDialer(tunnelServer)
return tunnelServer
}
func setupProxyDialer(tunnelServer *remotedialer.Server) {
app.DefaultProxyDialerFn = utilnet.DialFunc(func(_ context.Context, network, address string) (net.Conn, error) {
_, port, _ := net.SplitHostPort(address)
addr := "127.0.0.1"
if port != "" {
addr += ":" + port
}
nodeName, _ := kv.Split(address, ":")
return tunnelServer.Dial(nodeName, 15*time.Second, "tcp", addr)
})
}
func authorizer(req *http.Request) (clientKey string, authed bool, err error) {
user, ok := request.UserFrom(req.Context())
if !ok {
return "", false, nil
}
if user.GetName() != "node" {
return "", false, nil
}
nodeName := req.Header.Get("X-K3s-NodeName")
if nodeName == "" {
return "", false, nil
}
return nodeName, true, nil
}