In what area(s)?
/area networking
What version of Knative?
HEAD
Expected Behavior
queue-proxy's /quitquitquit endpoint can only be used by the Kubelet or privileged user.
If we hide it and change to use exec ReadinessProbe / LifecycleHooks this will be true.
Actual Behavior
queue-proxy's /quitquitquit endpoint can be accessible any user that can run code in the cluster.
Steps to Reproduce the Problem
- Create a pod that
curl <revision-pod>:8022/quitquitquit .
- See that such pod enters lameduck mode.
In what area(s)?
/area networking
What version of Knative?
Expected Behavior
queue-proxy's /quitquitquit endpoint can only be used by the Kubelet or privileged user.If we hide it and change to use
execReadinessProbe / LifecycleHooks this will be true.Actual Behavior
queue-proxy's /quitquitquit endpoint can be accessible any user that can run code in the cluster.Steps to Reproduce the Problem
curl <revision-pod>:8022/quitquitquit.