From b2f5fbeaac4ee664ab2e785ff548eff18aa60749 Mon Sep 17 00:00:00 2001 From: Mike Spreitzer Date: Fri, 24 Jul 2020 00:18:39 -0400 Subject: [PATCH] Document the health-for-strangers workaround .. to issue #93359 --- .../cluster-administration/flow-control.md | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/content/en/docs/concepts/cluster-administration/flow-control.md b/content/en/docs/concepts/cluster-administration/flow-control.md index 26fc1194df..6fb2a94a07 100644 --- a/content/en/docs/concepts/cluster-administration/flow-control.md +++ b/content/en/docs/concepts/cluster-administration/flow-control.md @@ -162,6 +162,42 @@ are built in and may not be overwritten: that only matches the `catch-all` FlowSchema will be rejected with an HTTP 429 error. +## Potentially interesting additional configuration + +The suggested configuration gives no special treatment to the health +check requests on kube-apiservers from their local kubelets --- which +tend to use the secured port but supply no credentials. With the +suggested config, these requests get assigned to the `global-default` +FlowSchema and the corresponding `global-default` priority level, +where other traffic can crowd them out. + +Adding the following additional FlowSchema will cause those requests +to be exempt from limiting. Unfortunately, any hostile party could +submit requests matching this FlowSchema. + +```yaml +apiVersion: flowcontrol.apiserver.k8s.io/v1alpha1 +kind: FlowSchema +metadata: + name: health-for-strangers +spec: + matchingPrecedence: 1000 + priorityLevelConfiguration: + name: exempt + rules: + - nonResourceRules: + - nonResourceURLs: + - "/healthz" + - "/livez" + - "/readyz" + verbs: + - "*" + subjects: + - kind: Group + group: + name: system:unauthenticated +``` + ## Resources The flow control API involves two kinds of resources. [PriorityLevelConfigurations](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#prioritylevelconfiguration-v1alpha1-flowcontrol-apiserver-k8s-io)