Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Expose DisableHTTP2 flag in SecureServingOptions #122176

Merged
merged 1 commit into from
May 9, 2024
Merged

Expose DisableHTTP2 flag in SecureServingOptions #122176

merged 1 commit into from
May 9, 2024

Conversation

slashpai
Copy link
Contributor

@slashpai slashpai commented Dec 5, 2023 •
edited by liggitt

This is to mitigate CVE-2023-44487
until the Go standard library and golang.org/x/net are fully fixed.

What type of PR is this?

What this PR does / why we need it:

Expose DisableHTTP2 flag in SecureServingOptions

This is to mitigate GHSA-qppj-fm5r-hxr3
until the Go standard library and golang.org/x/net
are fully fixed.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

This PR is created based on discussion in kubernetes-sigs/metrics-server#1364 (comment)

Does this PR introduce a user-facing change?

kube-apiserver: http/2 serving can be disabled with a `--disable-http2-serving` flag

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

cc: @dgrisonnet

@k8s-ci-robot k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Dec 5, 2023
@k8s-ci-robot
Copy link
Contributor

Please note that we're already in Test Freeze for the release-1.29 branch. This means every merged PR will be automatically fast-forwarded via the periodic ci-fast-forward job to the release branch of the upcoming v1.29.0 release.

Fast forwards are scheduled to happen every 6 hours, whereas the most recent run was: Tue Dec 5 04:13:37 UTC 2023.

@k8s-ci-robot k8s-ci-robot added do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Dec 5, 2023
@k8s-ci-robot
Copy link
Contributor

Welcome @slashpai!

It looks like this is your first PR to kubernetes/kubernetes 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/kubernetes has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@k8s-ci-robot k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Dec 5, 2023
@k8s-ci-robot
Copy link
Contributor

Hi @slashpai. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Dec 5, 2023
@rexagod
Copy link
Member

rexagod commented Dec 5, 2023

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Dec 5, 2023
@aojea
Copy link
Member

aojea commented Dec 5, 2023

dup of https://github.com/kubernetes/kubernetes/pull/116762/files

You and @enj should coordinate to only work in one PR

@slashpai
Copy link
Contributor Author

slashpai commented Dec 5, 2023

dup of https://github.com/kubernetes/kubernetes/pull/116762/files

You and @enj should coordinate to only work in one PR

Thank you. Didn't know another PR existed for same.
This was created as a followup from metrics-server PR discussion to do same.

@cici37
Copy link
Contributor

cici37 commented Dec 5, 2023

/triage accepted
Please feel free to close one of them if it has duplication. Thanks!

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Dec 5, 2023
@slashpai
Copy link
Contributor Author

slashpai commented Dec 6, 2023

@enj Would you be continuing with PR you already created for this? If not I can help 🙂

@rexagod
Copy link
Member

rexagod commented Feb 16, 2024

Since #116762 is closed now, I believe this PR can solely drive the effort forward.

@ChristianZaccaria
Copy link

Hi @slashpai, I was wondering what is the status of this PR? Is there more to be done on it? Very interested as this could potentially solve this 'High' CVE. Thank you!

@slashpai
Copy link
Contributor Author

I am looking for code review

@dgrisonnet please take a look if you get a chance

dgrisonnet
dgrisonnet reviewed Apr 26, 2024
View reviewed changes
staging/src/k8s.io/apiserver/pkg/server/options/serving.go Outdated
Comment on lines 168 to 169
fs.BoolVar(&s.DisableHTTP2, "disable-http2", s.DisableHTTP2,
"If true, HTTP2 will be disabled [default=false]")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that Jordan's comment still applies here: https://github.com/kubernetes/kubernetes/pull/116762/files#r1261602446

Maybe you could go with something like disable-serving-http2 and try to improve the help message to make it clearer to the users?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated please take a look

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me now

@slashpai
Expose DisableHTTP2 flag in SecureServingOptions
e2503e5 
This is to mitigate CVE-2023-44487
until the Go standard library and golang.org/x/net
are fully fixed.

Signed-off-by: Jayapriya Pai <janantha@redhat.com>
@dgrisonnet
Copy link
Member

@liggitt could you please take a look at this PR that supersede the effort started in #116762?

@liggitt
Copy link
Member

liggitt commented May 9, 2024

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 9, 2024
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: 44730b32d902c1cc3d3cd9ca76452daaf03618a5

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, slashpai

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 9, 2024
@liggitt
Copy link
Member

liggitt commented May 9, 2024

/kind feature

@k8s-ci-robot k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels May 9, 2024
@k8s-ci-robot k8s-ci-robot merged commit dfcb447 into kubernetes:master May 9, 2024
14 checks passed
@k8s-ci-robot k8s-ci-robot added this to the v1.31 milestone May 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dgrisonnet dgrisonnet dgrisonnet left review comments

@smarterclayton smarterclayton Awaiting requested review from smarterclayton

@wojtek-t wojtek-t Awaiting requested review from wojtek-t

Assignees

@liggitt liggitt

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
None yet
Milestone
v1.31
Development

Successfully merging this pull request may close these issues.

None yet
8 participants
@slashpai @k8s-ci-robot @rexagod @aojea @cici37 @ChristianZaccaria @dgrisonnet @liggitt