From 5e4746e96b72948e0708489efea2474139c1a983 Mon Sep 17 00:00:00 2001 From: Monis Khan Date: Fri, 12 Mar 2021 16:36:37 -0500 Subject: [PATCH] impersonator: match kube API server long running func Signed-off-by: Monis Khan --- internal/concierge/impersonator/impersonator.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/internal/concierge/impersonator/impersonator.go b/internal/concierge/impersonator/impersonator.go index 169d3aaf..87f2d1b4 100644 --- a/internal/concierge/impersonator/impersonator.go +++ b/internal/concierge/impersonator/impersonator.go @@ -22,6 +22,7 @@ import ( "k8s.io/apiserver/pkg/endpoints/request" genericapiserver "k8s.io/apiserver/pkg/server" "k8s.io/apiserver/pkg/server/dynamiccertificates" + "k8s.io/apiserver/pkg/server/filters" genericoptions "k8s.io/apiserver/pkg/server/options" "k8s.io/client-go/rest" "k8s.io/client-go/transport" @@ -123,6 +124,12 @@ func newInternal( //nolint:funlen // yeah, it's kind of long. // See sanity checks at the end of this function. serverConfig.LoopbackClientConfig.BearerToken = "" + // match KAS exactly since our long running operations are just a proxy to it + serverConfig.LongRunningFunc = filters.BasicLongRunningRequestCheck( + sets.NewString("watch", "proxy"), + sets.NewString("attach", "exec", "proxy", "log", "portforward"), + ) + // Assume proto config is safe because transport level configs do not use rest.ContentConfig. // Thus if we are interacting with actual APIs, they should be using pre-built clients. impersonationProxyFunc, err := newImpersonationReverseProxyFunc(rest.CopyConfig(kubeClient.ProtoConfig))