Handle error responses from backends

[liggitt]

What type of PR is this?
/kind bug

What this PR does / why we need it:
Handles error responses from backends

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #71411

Does this PR introduce a user-facing change?:

Fixes an issue with stuck connections handling error responses

/sig api-machinery
/cc sttts

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• staging/src/k8s.io/apimachinery/pkg/OWNERS [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[liggitt]

/retest

[sttts]

/lgtm

[jennybuckley]

/cc @wenjiaswe

[tossmilestone]

@liggitt Can I cherry-pick your change to our 1.9.x k8s to fix the issue?

[liggitt]

The 1.10 commit (#71415) would be a better one to pick to 1.9, just to avoid file drift issues (the change itself is fundamentally the same)

[cizixs]

@liggitt Why does this MR fixes #71411.

Seems to me this only handles connection upgrade error. And only the connection is established, client can still send any request skipping authorization.

[pdhung]

cizisx:
@liggitt Why does this MR fixes #71411.

Seems to me this only handles connection upgrade error. And only the connection is established, client can still send any request skipping authorization.

As far as I understand, in the buggy version, the connection upgrade error was not handled correctly when it happens, and the backend connection is left open, which leaves subsequent request to pass through to kubelet unchecked/unauthorized. Since API server authenticates to kubelet as cluster-admin, it allows attacker to run any API on kubelet.
This PR rectifies the problem by closing the backend connection.

[mgalgs]

Backend upgraded connection: Not verified ✔️

[moonek]

We noticed that this change only applies to the following releases.
v1.10.11
v1.11.5
v1.12.3
v1.13.0-rc.1

Our old environment is using k8s 1.8.4.
We are considering an upgrade k8s version, but it takes time.
So I want to hotfix this commit until then.

Does the k8s 1.8.4 source rebuild solve #71411 vulnerability by only reflecting this commit?

When checked with the test utility below, it appears to be resolved.
https://github.com/gravitational/cve-2018-1002105

[liggitt]

@moonek yes, this commit addresses #71411