kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

kops-controller: Return `http.StatusConflict` only when node is ready

This commit is contained in:
Ciprian Hacman 2023-05-27 12:58:50 +03:00
parent 7b545dde4b
commit 505c0c87de
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
cmd/kops-controller/pkg/server/server.go
View File

@ -30,8 +30,8 @@ import (
"runtime/debug" "runtime/debug"
"time" "time"
corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/errors"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
"k8s.io/apimachinery/pkg/types" "k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/util/sets" "k8s.io/apimachinery/pkg/util/sets"
"k8s.io/klog/v2" "k8s.io/klog/v2"
@ -175,16 +175,18 @@ func (s *Server) bootstrap(w http.ResponseWriter, r *http.Request) {
// Once the node is registered, we don't allow further registrations, this protects against a pod or escaped workload attempting to impersonate the node. // Once the node is registered, we don't allow further registrations, this protects against a pod or escaped workload attempting to impersonate the node.
{ {
node := &unstructured.Unstructured{} node := &corev1.Node{}
node.SetAPIVersion("v1")
node.SetKind("node")
err := s.uncachedClient.Get(ctx, types.NamespacedName{Name: id.NodeName}, node) err := s.uncachedClient.Get(ctx, types.NamespacedName{Name: id.NodeName}, node)
if err == nil { if err == nil {
for _, condition := range node.Status.Conditions {
if condition.Type == corev1.NodeReady && condition.Status == corev1.ConditionTrue {
klog.Infof("bootstrap %s node %q already exists; denying to avoid node-impersonation attacks", r.RemoteAddr, id.NodeName) klog.Infof("bootstrap %s node %q already exists; denying to avoid node-impersonation attacks", r.RemoteAddr, id.NodeName)
w.WriteHeader(http.StatusConflict) w.WriteHeader(http.StatusConflict)
_, _ = w.Write([]byte("node already registered")) _, _ = w.Write([]byte("node already registered"))
return return
} }
}
}
if err != nil && !errors.IsNotFound(err) { if err != nil && !errors.IsNotFound(err) {
klog.Infof("bootstrap %s error querying for node %q: %v", r.RemoteAddr, id.NodeName, err) klog.Infof("bootstrap %s error querying for node %q: %v", r.RemoteAddr, id.NodeName, err)
w.WriteHeader(http.StatusInternalServerError) w.WriteHeader(http.StatusInternalServerError)