13 Commits (f72649d1bd460471af1de7123ac72608f5290830)

Author	SHA1	Message	Date
Brad Davidson	b411864be5	Handle custom kubelet port in agent tunnel ... The kubelet port can be overridden by users; we shouldn't assume its always 10250 Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	11072e2516	Fix occasional "TLS handshake error" in apiserver network proxy. ... We should be reading from the hijacked bufio.ReaderWriter instead of directly from the net.Conn. There is a race condition where the underlying http handler may consume bytes from the hijacked request stream, if it comes in the same packet as the CONNECT header. These bytes are left in the buffered reader, which we were not using. This was causing us to occasionally drop a few bytes from the start of the tunneled connection's client data stream. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	5eaa0a9422	Replace getLocalhostIP with Loopback helper method ... Requires tweaking existing method signature to allow specifying whether or not IPv6 addresses should be return URL-safe. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	afee83dda2	Bump remotedialer ... Includes fix for recently identified memory leak. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	b550e1183a	Remove control-plane egress context and fix agent mode. ... The control-plane context handles requests outside the cluster and should not be sent to the proxy. In agent mode, we don't watch pods and just direct-dial any request for a non-node address, which is the original behavior. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	d3242bea3c	Refactor egress-selector pods mode to watch pods ... Watching pods appears to be the most reliable way to ensure that the proxy routes and authorizes connections. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Brad Davidson	9d7230496d	Add support for configuring the EgressSelector mode ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Brad Davidson	ce5b9347c9	Replace DefaultProxyDialerFn dialer injection with EgressSelector support ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Brad Davidson	af0b496ef3	Add client certificate authentication support to core Authenticator ... This is required to make the websocket tunnel server functional on etcd-only nodes, and will save some code on the RKE2 side once pulled through. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Darren Shepherd	3396a7b099	If tunnel session does not exist fallback to default dialer	5 years ago
Darren Shepherd	ba240d0611	Refactor tokens, bootstrap, and cli args	5 years ago
Darren Shepherd	c0702b0492	Port to wrangler	6 years ago
Darren Shepherd	9bb7c27c62	Initial Commit	6 years ago