WIP Kube exec proxy
-
check licenses of new code -
restrict websocket connections to signed-in GitLab users -
disable websocket endpoint by default
Merge request reports
Activity
Added 7 commits:
-
67376ca7...8abee43f - 6 commits from branch
master - 862e96cd - Merge branch 'master' of https://gitlab.com/gitlab-org/gitlab-workhorse into kube-exec-proxy
-
67376ca7...8abee43f - 6 commits from branch
Added 1 commit:
- 55f35da5 - Fix goroutine leak if socket closes before command
Working on security features in https://gitlab.com/gitlab-org/gitlab-workhorse/merge_requests/75 to prevent conflict with demo today. cc @ayufan
We should think about how long a terminal websocket is supposed to last. The way this is implemented now, even if you block or remove the user from GitLab, their terminal websocket keeps working.
If everything is quiet for long enough NGINX will terminate the websocket connection. That is not a security mechanism. So perhaps we need some sort of polling from gitlab-workhorse to gitlab-ce to see if the user is still allowed to access the terminal.
Mentioned in merge request !75 (closed)
@JobV could you comment whether these licenses are OK:
- https://gitlab.com/gitlab-org/gitlab-workhorse/blob/kube-exec-proxy/vendor/github.com/kr/pty/License
- https://gitlab.com/gitlab-org/gitlab-workhorse/blob/kube-exec-proxy/vendor/golang.org/x/net/LICENSE
- https://gitlab.com/gitlab-org/gitlab-workhorse/blob/kube-exec-proxy/vendor/golang.org/x/text/LICENSE
- https://gitlab.com/gitlab-org/gitlab-workhorse/blob/kube-exec-proxy/internal/terminal/LICENSE
Edited by Jacob Vosmaer (GitLab)45 45 var apiLimit = flag.Uint("apiLimit", 0, "Number of API requests allowed at single time") 46 46 var apiQueueLimit = flag.Uint("apiQueueLimit", 0, "Number of API requests allowed to be queued") 47 47 var apiQueueTimeout = flag.Duration("apiQueueDuration", queueing.DefaultTimeout, "Maximum queueing duration of requests") 48 var websocketTerminalEnabled = flag.Bool("websocketTerminal", false, "Experimental INSECURE websocket terminal feature") @jacobvosmaer-gitlab they are all fine.
Great work @jacobvosmaer-gitlab. This is quite the MR!
Added 1 commit:
- f8b30f5d - Start 'kubectl exec' instead of bash
Thanks @JobV
Thanks @stanhu , it contains work from Ev, I did not do it alone.
Added 1 commit:
- 970975b2 - Use openshift token and server from gitlab-rails
Added 1 commit:
- 6d0f6739 - Reduce security: skip certificate verification
Mentioned in merge request !83 (merged)
mentioned in commit d01ee210
Superseded by !83 (merged)
