mirror of https://github.com/linkerd/linkerd2.git
c9c41e2e8a
### Summary As an initial attempt to secure the connection from clients to the gRPC tap server on the tap Pod, the tap `addr` only listened on localhost. As @adleong pointed out #3257, this was not actually secure because the inbound proxy would establish a connection to localhost anyways. This change removes the gRPC tap server listener and changes `TapByResource` requests to interface with the server object directly. From this, we know that all `TapByResourceRequests` have gone through the tap APIServer and thus authorized by RBAC. ### Details [NewAPIServer]( |
||
|---|---|---|
| .. | ||
| apiserver.go | ||
| apiserver_test.go | ||
| client.go | ||
| handlers.go | ||
| handlers_test.go | ||
| server.go | ||
| server_test.go | ||