k8s.io/apiserver@v0.31.1/pkg/server/config_selfclient.go (about)

     1  /*
     2  Copyright 2016 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package server
    18  
    19  import (
    20  	"fmt"
    21  	"net"
    22  
    23  	restclient "k8s.io/client-go/rest"
    24  	netutils "k8s.io/utils/net"
    25  )
    26  
    27  // LoopbackClientServerNameOverride is passed to the apiserver from the loopback client in order to
    28  // select the loopback certificate via SNI if TLS is used.
    29  const LoopbackClientServerNameOverride = "apiserver-loopback-client"
    30  
    31  func (s *SecureServingInfo) NewClientConfig(caCert []byte) (*restclient.Config, error) {
    32  	if s == nil || (s.Cert == nil && len(s.SNICerts) == 0) {
    33  		return nil, nil
    34  	}
    35  
    36  	host, port, err := LoopbackHostPort(s.Listener.Addr().String())
    37  	if err != nil {
    38  		return nil, err
    39  	}
    40  
    41  	return &restclient.Config{
    42  		// Do not limit loopback client QPS.
    43  		QPS:  -1,
    44  		Host: "https://" + net.JoinHostPort(host, port),
    45  		TLSClientConfig: restclient.TLSClientConfig{
    46  			CAData: caCert,
    47  		},
    48  	}, nil
    49  }
    50  
    51  func (s *SecureServingInfo) NewLoopbackClientConfig(token string, loopbackCert []byte) (*restclient.Config, error) {
    52  	c, err := s.NewClientConfig(loopbackCert)
    53  	if err != nil || c == nil {
    54  		return c, err
    55  	}
    56  
    57  	c.BearerToken = token
    58  	// override the ServerName to select our loopback certificate via SNI. This name is also
    59  	// used by the client to compare the returns server certificate against.
    60  	c.TLSClientConfig.ServerName = LoopbackClientServerNameOverride
    61  
    62  	return c, nil
    63  }
    64  
    65  // LoopbackHostPort returns the host and port loopback REST clients should use
    66  // to contact the server.
    67  func LoopbackHostPort(bindAddress string) (string, string, error) {
    68  	host, port, err := net.SplitHostPort(bindAddress)
    69  	if err != nil {
    70  		// should never happen
    71  		return "", "", fmt.Errorf("invalid server bind address: %q", bindAddress)
    72  	}
    73  
    74  	isIPv6 := netutils.IsIPv6String(host)
    75  
    76  	// Value is expected to be an IP or DNS name, not "0.0.0.0".
    77  	if host == "0.0.0.0" || host == "::" {
    78  		// Get ip of local interface, but fall back to "localhost".
    79  		// Note that "localhost" is resolved with the external nameserver first with Go's stdlib.
    80  		// So if localhost.<yoursearchdomain> resolves, we don't get a 127.0.0.1 as expected.
    81  		host = getLoopbackAddress(isIPv6)
    82  	}
    83  	return host, port, nil
    84  }
    85  
    86  // getLoopbackAddress returns the ip address of local loopback interface. If any error occurs or loopback interface is not found, will fall back to "localhost"
    87  func getLoopbackAddress(wantIPv6 bool) string {
    88  	addrs, err := net.InterfaceAddrs()
    89  	if err == nil {
    90  		for _, address := range addrs {
    91  			if ipnet, ok := address.(*net.IPNet); ok && ipnet.IP.IsLoopback() && wantIPv6 == netutils.IsIPv6(ipnet.IP) {
    92  				return ipnet.IP.String()
    93  			}
    94  		}
    95  	}
    96  	return "localhost"
    97  }