ClientConfig should not default to http://localhost:8080#30808
Conversation
|
lgtm |
|
Added a release note. |
|
@kubernetes/sig-api-machinery |
958af85 to
ea384e7
Compare
|
Any other comments on top of David's review? |
|
none from me. |
|
lgtm |
|
@k8s-bot ok to test, issue: #IGNORE |
|
Can one of the admins verify that this patch is reasonable to test? If so, please reply "ok to test". This message will repeat several times in short succession due to jenkinsci/ghprb-plugin#292. Sorry. |
|
@smarterclayton looks like this is breaking a test. Might want to take a look if you want this in v1.4 |
|
Ah, new code added. Will fix. |
This changes clientcmd to skip the default cluster, but preserves the behavior in kubectl. This prevents the possibility of an administrator misconfiguration in kubelet or other server component from allowing a third party who can bind to 8080 on that host from potentially impersonating an API server and gaining root access.
ea384e7 to
06cbb29
Compare
|
GCE e2e build/test passed for commit 06cbb29. |
|
Fixed the new test the same way, reapplying label |
|
@k8s-bot test this [submit-queue is verifying that this PR is safe to merge] |
|
GCE e2e build/test passed for commit 06cbb29. |
|
Automatic merge from submit-queue |
This changes clientcmd to skip the default cluster, but preserves the
behavior in kubectl. This prevents the possibility of an administrator
misconfiguration in kubelet or other server component from allowing a
third party who can bind to 8080 on that host from potentially
impersonating an API server and gaining root access.
@mikedanese @deads2k this removes the defaulting of http://localhost:8080 for server from everything except kubectl.
This change is