feat!: Add config to disable proxy /shutdown admin endpoint (#12705)

The proxy may expose a /shutdown HTTP endpoint on its admin server that may be used by `linkerd-await --shutdown` to trigger proxy shutdown after a process completes. If an application has an SSRF vulnerability, however, an attacker could use this endpoint to trigger proxy shutdown, causing a denial of service. This admin endpoint is only useful with linkerd-await; and this functionality is supplanted by Kubernetes Native Sidecars.

To address this potential issue, this change disables the proxy's admin endpoint by default. A helm value is introduced to support enabling the admin endpoint cluster-wide; and the `config.linkerd.io/proxy-admin-shutdown: enabled` annotation may be set to enable it the admin endpoint on an individual workload.

Signed-off-by: Alex Leong <alex@buoyant.io>

charts/linkerd-control-plane/README.md

@@ -241,6 +241,7 @@ Kubernetes: `>=1.22.0-0`
 | proxy.disableInboundProtocolDetectTimeout | bool | `false` | When set to true, disables the protocol detection timeout on the inbound side of the proxy by setting it to a very high value |
 | proxy.disableOutboundProtocolDetectTimeout | bool | `false` | When set to true, disables the protocol detection timeout on the outbound side of the proxy by setting it to a very high value |
 | proxy.enableExternalProfiles | bool | `false` | Enable service profiles for non-Kubernetes services |
+| proxy.enableShutdownEndpoint | bool | `false` | Enables the proxy's /shutdown admin endpoint |
 | proxy.gid | int | `-1` | Optional customisation of the group id under which the proxy runs (the group ID will be omitted if lower than 0) |
 | proxy.image.name | string | `"cr.l5d.io/linkerd/proxy"` | Docker image for the proxy |
 | proxy.image.pullPolicy | string | imagePullPolicy | Pull policy for the proxy container image |

charts/linkerd-control-plane/values.yaml

@@ -149,6 +149,8 @@ proxy:
     # -- Tag for the proxy container image
     # @default -- linkerdVersion
     version: ""
+  # -- Enables the proxy's /shutdown admin endpoint
+  enableShutdownEndpoint: false
   # -- Log level for the proxy
   logLevel: warn,linkerd=info,hickory=error
   # -- Log format (`plain` or `json`) for the proxy

charts/partials/templates/_proxy.tpl

@@ -31,6 +31,8 @@ env:
 - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
   value: {{.Values.proxy.requireTLSOnInboundPorts | quote}}
 {{ end -}}
+- name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+  value: {{.Values.proxy.enableShutdownEndpoint | quote}}
 - name: LINKERD2_PROXY_LOG
   value: "{{.Values.proxy.logLevel}}{{ if not (eq .Values.proxy.logHTTPHeaders "insecure") }},linkerd_proxy_http::client[{headers}]=off{{ end }}"
 - name: LINKERD2_PROXY_LOG_FORMAT

cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml

@@ -32,6 +32,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT

cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml

@@ -32,6 +32,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
@@ -267,6 +269,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT

cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml

@@ -32,6 +32,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT