Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Investigate adding per-request binding or assertions to apiserver proxy #72116

Open
liggitt opened this issue Dec 17, 2018 · 3 comments
Open

Investigate adding per-request binding or assertions to apiserver proxy #72116

liggitt opened this issue Dec 17, 2018 · 3 comments
Labels
area/apiserver area/security kind/feature Categorizes issue or PR as related to a new feature. lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery.

Comments

@liggitt
Copy link
Member

liggitt commented Dec 17, 2018

Investigate adding per-request binding or assertions that would let backends verify a particular request was intentionally forwarded from the apiserver proxy

From CVE-2018-1002105 post-mortem

/area security
/area apiserver
/priority important-longterm
/kind cleanup
/sig api-machinery
@k8s-ci-robot k8s-ci-robot added area/security area/apiserver priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. labels Dec 17, 2018
@liggitt liggitt changed the title Investigate adding per-request binding or assertions Investigate adding per-request binding or assertions to apiserver proxy Dec 17, 2018
@liggitt liggitt added the kind/feature Categorizes issue or PR as related to a new feature. label Dec 17, 2018
@fedebongio
Copy link
Contributor

/cc @cheftako

@liggitt liggitt removed the kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. label Dec 23, 2018
@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 23, 2019
@fejta-bot
Copy link

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

@k8s-ci-robot k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Apr 22, 2019
@mikedanese mikedanese added lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. and removed lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. labels May 6, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/apiserver area/security kind/feature Categorizes issue or PR as related to a new feature. lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@liggitt @mikedanese @fedebongio @k8s-ci-robot @fejta-bot