Skip to content

Hide the admin endpoint of queue-proxy #3279

Description

@tcnghia

In what area(s)?

/area networking

What version of Knative?

HEAD

Expected Behavior

queue-proxy's /quitquitquit endpoint can only be used by the Kubelet or privileged user.

If we hide it and change to use exec ReadinessProbe / LifecycleHooks this will be true.

Actual Behavior

queue-proxy's /quitquitquit endpoint can be accessible any user that can run code in the cluster.

Steps to Reproduce the Problem

  • Create a pod that curl <revision-pod>:8022/quitquitquit .
  • See that such pod enters lameduck mode.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions