Input validation (IP validation)

Proof-of-concept (PoC) to reproduce pre-fix behavior in a controlled lab: 1) Set up a test Kubernetes control plane and start the API server with an invalid advertise-address, e.g. --advertise-address=256.0.0.1 (or set the corresponding field in the static manifest used by the control-plane). 2) Observe that the API server starts and begins endpoint reconciliation, potentially stuffing an invalid IP into the Endpoints object for the kubernetes service. 3) Verify the Endpoints for the kubernetes service reflect the invalid IP. Example using kubectl: kubectl get endpoints kubernetes -n default -o jsonpath='{.subsets[].addresses[].ip}' This may show an invalid IP such as 256.0.0.1, which is non-routable and will fail clients attempting to use it. 4) Demonstrate impact: a client or component attempting to reach the API server via that endpoint IP would fail, causing connectivity issues or service disruption. Remediation in a patched cluster would reject 256.0.0.1 at startup and prevent the misconfigured IP from being used in endpoint reconciliation. Note: This PoC is intended for a controlled lab/test environment. Do not attempt on production clusters. The PoC assumes you can configure the API server via its manifest or startup flags and observe the kubernetes service Endpoints in the default namespace.

diff --git a/cmd/kube-apiserver/app/testing/testserver.go b/cmd/kube-apiserver/app/testing/testserver.go index f6451bfe3743e..288ee202c7044 100644 --- a/cmd/kube-apiserver/app/testing/testserver.go +++ b/cmd/kube-apiserver/app/testing/testserver.go @@ -355,6 +355,12 @@ func StartTestServer(t ktesting.TB, instanceOptions *TestServerInstanceOptions, if err := fs.Parse(customFlags); err != nil { return result, err } + + // disable endpoint reconciliation when using a loopback "external" address + // unless the user has explicitly overridden the reconciler or advertise address + if !fs.Changed("advertise-address") && !fs.Changed("endpoint-reconciler-type") { + s.EndpointReconcilerType = "none" + } if utilfeature.DefaultFeatureGate.Enabled(zpagesfeatures.ComponentFlagz) { s.Flagz = flagz.NamedFlagSetsReader{FlagSets: namedFlagSets} } diff --git a/pkg/controlplane/instance.go b/pkg/controlplane/instance.go index 62b38b0370d07..ed1c65565fb06 100644 --- a/pkg/controlplane/instance.go +++ b/pkg/controlplane/instance.go @@ -346,6 +346,11 @@ func (c CompletedConfig) New(delegationTarget genericapiserver.DelegationTarget) if err != nil { return nil, fmt.Errorf("failed to get listener address: %w", err) } + + if err := c.Extra.EndpointReconcilerConfig.Reconciler.ValidateIP(c.ControlPlane.Generic.PublicAddress); err != nil { + return nil, fmt.Errorf("cannot use public IP %s with endpoint reconciler: %w", c.ControlPlane.Generic.PublicAddress.String(), err) + } + kubernetesServiceCtrl := kubernetesservice.New(kubernetesservice.Config{ PublicIP: c.ControlPlane.Generic.PublicAddress, diff --git a/pkg/controlplane/reconcilers/instancecount.go b/pkg/controlplane/reconcilers/instancecount.go index 6b6282800a909..51125745e26ce 100644 --- a/pkg/controlplane/reconcilers/instancecount.go +++ b/pkg/controlplane/reconcilers/instancecount.go @@ -27,6 +27,7 @@ import ( "k8s.io/client-go/util/retry" "k8s.io/klog/v2" endpointsv1 "k8s.io/kubernetes/pkg/api/v1/endpoints" + "k8s.io/kubernetes/pkg/apis/core/validation" ) // masterCountEndpointReconciler reconciles endpoints based on a specified expected number of @@ -47,6 +48,10 @@ func NewMasterCountEndpointReconciler(masterCount int, epAdapter EndpointsAdapte } } +func (r *masterCountEndpointReconciler) ValidateIP(ip net.IP) error { + return validation.ValidateEndpointIP(ip.String(), nil).ToAggregate() +} + // ReconcileEndpoints sets the endpoints for the given apiserver service (ro or rw). // ReconcileEndpoints expects that the endpoints objects it manages will all be // managed only by ReconcileEndpoints; therefore, to understand this, you need only diff --git a/pkg/controlplane/reconcilers/lease.go b/pkg/controlplane/reconcilers/lease.go index a6c5782900013..5be7068902150 100644 --- a/pkg/controlplane/reconcilers/lease.go +++ b/pkg/controlplane/reconcilers/lease.go @@ -41,6 +41,7 @@ import ( "k8s.io/apiserver/pkg/storage/storagebackend" storagefactory "k8s.io/apiserver/pkg/storage/storagebackend/factory" endpointsv1 "k8s.io/kubernetes/pkg/api/v1/endpoints" + "k8s.io/kubernetes/pkg/apis/core/validation" ) // Leases is an interface which assists in managing the set of active masters @@ -162,6 +163,10 @@ func NewLeaseEndpointReconciler(epAdapter EndpointsAdapter, masterLeases Leases) } } +func (r *leaseEndpointReconciler) ValidateIP(ip net.IP) error { + return validation.ValidateEndpointIP(ip.String(), nil).ToAggregate() +} + // ReconcileEndpoints lists keys in a special etcd directory. // Each key is expected to have a TTL of R+n, where R is the refresh interval // at which this function is called, and n is some small value. If an diff --git a/pkg/controlplane/reconcilers/none.go b/pkg/controlplane/reconcilers/none.go index e7ff7ea7e36af..2d85a4f3ab56f 100644 --- a/pkg/controlplane/reconcilers/none.go +++ b/pkg/controlplane/reconcilers/none.go @@ -32,6 +32,10 @@ func NewNoneEndpointReconciler() EndpointReconciler { return &noneEndpointReconciler{} } +func (r *noneEndpointReconciler) ValidateIP(ip net.IP) error { + return nil +} + // ReconcileEndpoints noop reconcile func (r *noneEndpointReconciler) ReconcileEndpoints(serviceName string, ip net.IP, endpointPorts []corev1.EndpointPort, reconcilePorts bool) error { return nil diff --git a/pkg/controlplane/reconcilers/reconcilers.go b/pkg/controlplane/reconcilers/reconcilers.go index b0dcd465eeffa..a1f6a4c2a53cc 100644 --- a/pkg/controlplane/reconcilers/reconcilers.go +++ b/pkg/controlplane/reconcilers/reconcilers.go @@ -25,6 +25,10 @@ import ( // EndpointReconciler knows how to reconcile the endpoints for the apiserver service. type EndpointReconciler interface { + // ValidateIP ensures the given IP address meets any requirements to + // successfully call ReconcileEndpoints with this reconciler type. + ValidateIP(ip net.IP) error + // ReconcileEndpoints sets the endpoints for the given apiserver service (ro or rw). // ReconcileEndpoints expects that the endpoints objects it manages will all be // managed only by ReconcileEndpoints; therefore, to understand this, you need only