New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Header Connection: close
causes kubectl
to fail exec
#33050
Conversation
The header `Connection: close` causes failure in kubetl when it upgrades the connection to SPDY. The `ReadTimeout` and `WriteTimeout` are known to cause problems to Kubernetes watch streams. Fixes #33020 Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please add a test to prevent regression.
I added a test in tsh package that tests kubectl exec flow to prevent regressions |
// runKubectlExec runs a kubectl exec command in a dummy pod. | ||
// The mock Kubernetes API server will return the pod name and the stdin data | ||
// written to the pod. | ||
func runKubectlExec(t *testing.T, config *rest.Config) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there a cheap way to replace mustGetKubePod
in integration tests with doing kubectl exec? Or maybe the integration tests should do both?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You mean downloading kubectl instead of running all this weird logic?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No, I meant replicating what you did in tsh tests in this PR in integration tests for kube proxy. If integration tests also did exec into a container then maybe we'd have caught that sooner.
I typically also did just kubectl get po -A
to verify that kube access in Connect works as expected, but I'm going to update the test plan to explicitly mention execing into a container.
The header
Connection: close
causes failure in kubectl when it upgrades the connection to SPDY.The
ReadTimeout
andWriteTimeout
are known to cause problems with Kubernetes watch streams.Fixes #33020