Kube proxy is blocking PATCH requests intended to be forwarded through kubectl proxy

[crestenstclair]

What keywords did you search in Kubernetes issues before filing this one? (If you have found any duplicates, you should instead reply there.):

• the server does not allow this method on the requested resource
• Kubernetes
• Kubectl proxy patch request

---

Is this a BUG REPORT or FEATURE REQUEST? (choose one):
Bug

Kubernetes version* (use kubectl version):

Client Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1", GitCommit:"82450d03cb057bab0950214ef122b67c83fb11df", GitTreeState:"clean", BuildDate:"2016-12-14T00:57:05
Z", GoVersion:"go1.7.4", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"4", GitVersion:"v1.4.8", GitCommit:"c5fcb1951afb8150e4574bc234aed957cb586eb0", GitTreeState:"clean", BuildDate:"2017-01-12T02:14:29
Z", GoVersion:"go1.6.3", Compiler:"gc", Platform:"linux/amd64"}

Environment:

• Cloud provider or hardware configuration: Google Container Engine
• OS (e.g. from /etc/os-release): Google Container Engine
• Kernel (e.g. uname -a):
  Linux gke-[redacted]-default-pool-766375c0-dp8p 4.4.21+ Unit test coverage in Kubelet is lousy. (~30%) #1 SMP Thu Nov 10 21:43:53 PST 2016 x86_64 Intel(R) Xeon(R) CPU @ 2.60GHz GenuineIntel GNU/Linux
• Install tools:
  kubectl proxy

What happened:

I created a very nginx basic nginx replication controller, and a service that points to that nginx server.

Then, I use kubectl proxy and do this request:

curl "http://localhost:8001/api/v1/proxy/namespaces/default/services/nginx:80" -X GET

This works fine. But! When I do this request:

10057 ◯  curl "http://localhost:8001/api/v1/proxy/namespaces/default/services/nginx:80" -X PATCH
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "the server does not allow this method on the requested resource",
  "reason": "MethodNotAllowed",
  "details": {},
  "code": 405
}%

I get that error message.

I assume that Kubernetes thinks I'm trying to modify the proxy service resource, and rejects me. But what I'm TRYING to do is send a PATCH request to the pod that service directs traffic to.

What you expected to happen:

The proxy would successfully forward my request even if it is a patch.

How to reproduce it (as minimally and precisely as possible):

Create a new cluster, and create these resources:

Replication controller:

  "apiVersion": "v1",
  "kind": "ReplicationController",
  "metadata": {
    "labels": {
      "name": "nginx"
    },
    "name": "nginx",
    "namespace": "default"
  },
  "spec": {
    "replicas": 1,
    "selector": {
      "name": "nginx"
    },
    "template": {
      "metadata": {
        "labels": {
          "name": "nginx"
        }
      },
      "spec": {
        "containers": [
          {
            "name": "nginx",
            "imagePullPolicy": "Always",
            "image": "nginx"
          }
        ]
      }
    }
  }
}

Service:

{
  "apiVersion": "v1",
  "kind": "Service",
  "metadata": {
    "labels": {
      "name": "nginx"
    },
    "name": "nginx",
    "namespace": "default"
  },
  "spec": {
    "ports": [
      {
        "port": 80,
        "targetPort": 80
      }
    ],
    "selector": {
      "name": "nginx"
    }
  }
}

Then kubectl proxy

and run this command: curl "http://localhost:8001/api/v1/proxy/namespaces/default/services/nginx:80" -X PATCH

[0xmichalis]

@thockin @deads2k

[thockin]

@lavalamp apiserver proxy != kube-proxy :)

…

On Wed, Jan 25, 2017 at 2:23 AM, Michail Kargakis ***@***.***> wrote: @thockin <https://github.com/thockin> @deads2k <https://github.com/deads2k> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#40383 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFVgVCvqpVSkN4u_7dfpD-tUARdt26O-ks5rVyKRgaJpZM4Lsvxw> .

[liggitt]

I'd recommend you use the proxy subresource on the service, which does support patch:

curl "http://localhost:8001/api/v1/namespaces/default/services/nginx:80/proxy" -X PATCH

[liggitt]

Not sure if we want to continue to expand the root proxy capabilities, but if we do, #41421 adds patch support