Skip to content

Commit 4526fcf

Browse files
everettraveneverettraven
committed
rapid reset cve scaffold remediations
Signed-off-by: everettraven <[email protected]>
1 parent c856aee commit 4526fcf

File tree

9 files changed

+240
-15
lines changed
  • docs/book/src/cronjob-tutorial/testdata/project/cmd
  • pkg/plugins/golang
    • v3/scaffolds/internal/templates
    • v4/scaffolds/internal/templates
  • testdata

9 files changed

+240
-15
lines changed

‎docs/book/src/cronjob-tutorial/testdata/project/cmd/main.go

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ limitations under the License.
1818
package main
1919

2020
import (
21+
"crypto/tls"
2122
"flag"
2223
"os"
2324

@@ -32,6 +33,7 @@ import (
3233
"sigs.k8s.io/controller-runtime/pkg/healthz"
3334
"sigs.k8s.io/controller-runtime/pkg/log/zap"
3435
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
36+
"sigs.k8s.io/controller-runtime/pkg/webhook"
3537

3638
batchv1 "tutorial.kubebuilder.io/project/api/v1"
3739
"tutorial.kubebuilder.io/project/internal/controller"
@@ -72,11 +74,17 @@ func main() {
7274
var metricsAddr string
7375
var enableLeaderElection bool
7476
var probeAddr string
77+
var secureMetrics bool
78+
var enableHTTP2 bool
7579
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
7680
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
7781
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
7882
"Enable leader election for controller manager. "+
7983
"Enabling this will ensure there is only one active controller manager.")
84+
flag.BoolVar(&secureMetrics, "metrics-secure", false,
85+
"Whether or not the metrics endpoint should be served securely")
86+
flag.BoolVar(&enableHTTP2, "enable-http2", false,
87+
"Whether or not HTTP/2 should be enabled for the metrics and webhook servers")
8088
opts := zap.Options{
8189
Development: true,
8290
}
@@ -85,9 +93,28 @@ func main() {
8593

8694
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
8795

96+
disableHTTP2 := func(c *tls.Config) {
97+
setupLog.Info("disabling http/2")
98+
c.NextProtos = []string{"http/1.1"}
99+
}
100+
101+
tlsOpts := []func(*tls.Config){}
102+
if !enableHTTP2 {
103+
tlsOpts = append(tlsOpts, disableHTTP2)
104+
}
105+
106+
webhookServer := webhook.NewServer(webhook.Options{
107+
TLSOpts: tlsOpts,
108+
})
109+
88110
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
89-
Scheme: scheme,
90-
Metrics: metricsserver.Options{BindAddress: metricsAddr},
111+
Scheme: scheme,
112+
Metrics: metricsserver.Options{
113+
BindAddress: metricsAddr,
114+
SecureServing: secureMetrics,
115+
TLSOpts: tlsOpts,
116+
},
117+
WebhookServer: webhookServer,
91118
HealthProbeBindAddress: probeAddr,
92119
LeaderElection: enableLeaderElection,
93120
LeaderElectionID: "80807133.tutorial.kubebuilder.io",

‎pkg/plugins/golang/v3/scaffolds/internal/templates/main.go

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,7 @@ var mainTemplate = `{{ .Boilerplate }}
185185
package main
186186
187187
import (
188+
"crypto/tls"
188189
"flag"
189190
"os"
190191
@@ -198,6 +199,7 @@ import (
198199
ctrl "sigs.k8s.io/controller-runtime"
199200
"sigs.k8s.io/controller-runtime/pkg/log/zap"
200201
"sigs.k8s.io/controller-runtime/pkg/healthz"
202+
"sigs.k8s.io/controller-runtime/pkg/webhook"
201203
%s
202204
)
203205
@@ -217,11 +219,14 @@ func main() {
217219
var metricsAddr string
218220
var enableLeaderElection bool
219221
var probeAddr string
222+
var enableHTTP2 bool
220223
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
221224
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
222225
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
223226
"Enable leader election for controller manager. " +
224227
"Enabling this will ensure there is only one active controller manager.")
228+
flag.BoolVar(&enableHTTP2, "enable-http2", false,
229+
"Whether or not HTTP/2 should be enabled for the metrics and webhook servers")
225230
{{- else }}
226231
var configFile string
227232
flag.StringVar(&configFile, "config", "",
@@ -238,9 +243,22 @@ func main() {
238243
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
239244
240245
{{ if not .ComponentConfig }}
246+
disableHTTP2 := func(c *tls.Config) {
247+
setupLog.Info("disabling http/2")
248+
c.NextProtos = []string{"http/1.1"}
249+
}
250+
251+
tlsOpts := []func(*tls.Config){}
252+
if !enableHTTP2 {
253+
tlsOpts = append(tlsOpts, disableHTTP2)
254+
}
255+
241256
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
242257
Scheme: scheme,
243258
MetricsBindAddress: metricsAddr,
259+
WebhookServer: &webhook.Server{
260+
TLSOpts: tlsOpts,
261+
},
244262
Port: 9443,
245263
HealthProbeBindAddress: probeAddr,
246264
LeaderElection: enableLeaderElection,

‎pkg/plugins/golang/v4/scaffolds/internal/templates/main.go

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,7 @@ var mainTemplate = `{{ .Boilerplate }}
187187
package main
188188
189189
import (
190+
"crypto/tls"
190191
"flag"
191192
"os"
192193
@@ -200,6 +201,7 @@ import (
200201
ctrl "sigs.k8s.io/controller-runtime"
201202
"sigs.k8s.io/controller-runtime/pkg/log/zap"
202203
"sigs.k8s.io/controller-runtime/pkg/healthz"
204+
"sigs.k8s.io/controller-runtime/pkg/webhook"
203205
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
204206
%s
205207
)
@@ -220,11 +222,17 @@ func main() {
220222
var metricsAddr string
221223
var enableLeaderElection bool
222224
var probeAddr string
225+
var secureMetrics bool
226+
var enableHTTP2 bool
223227
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
224228
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
225229
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
226230
"Enable leader election for controller manager. " +
227231
"Enabling this will ensure there is only one active controller manager.")
232+
flag.BoolVar(&secureMetrics, "metrics-secure", false,
233+
"Whether or not the metrics endpoint should be served securely")
234+
flag.BoolVar(&enableHTTP2, "enable-http2", false,
235+
"Whether or not HTTP/2 should be enabled for the metrics and webhook servers")
228236
{{- else }}
229237
var configFile string
230238
flag.StringVar(&configFile, "config", "",
@@ -241,9 +249,28 @@ func main() {
241249
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
242250
243251
{{ if not .ComponentConfig }}
252+
disableHTTP2 := func(c *tls.Config) {
253+
setupLog.Info("disabling http/2")
254+
c.NextProtos = []string{"http/1.1"}
255+
}
256+
257+
tlsOpts := []func(*tls.Config){}
258+
if !enableHTTP2 {
259+
tlsOpts = append(tlsOpts, disableHTTP2)
260+
}
261+
262+
webhookServer := webhook.NewServer(webhook.Options{
263+
TLSOpts: tlsOpts,
264+
})
265+
244266
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
245267
Scheme: scheme,
246-
Metrics: metricsserver.Options{BindAddress: metricsAddr},
268+
Metrics: metricsserver.Options{
269+
BindAddress: metricsAddr,
270+
SecureServing: secureMetrics,
271+
TLSOpts: tlsOpts,
272+
},
273+
WebhookServer: webhookServer,
247274
HealthProbeBindAddress: probeAddr,
248275
LeaderElection: enableLeaderElection,
249276
LeaderElectionID: "{{ hashFNV .Repo }}.{{ .Domain }}",

‎testdata/project-v3/main.go

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ limitations under the License.
1717
package main
1818

1919
import (
20+
"crypto/tls"
2021
"flag"
2122
"os"
2223

@@ -30,6 +31,7 @@ import (
3031
ctrl "sigs.k8s.io/controller-runtime"
3132
"sigs.k8s.io/controller-runtime/pkg/healthz"
3233
"sigs.k8s.io/controller-runtime/pkg/log/zap"
34+
"sigs.k8s.io/controller-runtime/pkg/webhook"
3335

3436
crewv1 "sigs.k8s.io/kubebuilder/testdata/project-v3/api/v1"
3537
"sigs.k8s.io/kubebuilder/testdata/project-v3/controllers"
@@ -52,11 +54,14 @@ func main() {
5254
var metricsAddr string
5355
var enableLeaderElection bool
5456
var probeAddr string
57+
var enableHTTP2 bool
5558
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
5659
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
5760
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
5861
"Enable leader election for controller manager. "+
5962
"Enabling this will ensure there is only one active controller manager.")
63+
flag.BoolVar(&enableHTTP2, "enable-http2", false,
64+
"Whether or not HTTP/2 should be enabled for the metrics and webhook servers")
6065
opts := zap.Options{
6166
Development: true,
6267
}
@@ -65,9 +70,22 @@ func main() {
6570

6671
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
6772

73+
disableHTTP2 := func(c *tls.Config) {
74+
setupLog.Info("disabling http/2")
75+
c.NextProtos = []string{"http/1.1"}
76+
}
77+
78+
tlsOpts := []func(*tls.Config){}
79+
if !enableHTTP2 {
80+
tlsOpts = append(tlsOpts, disableHTTP2)
81+
}
82+
6883
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
69-
Scheme: scheme,
70-
MetricsBindAddress: metricsAddr,
84+
Scheme: scheme,
85+
MetricsBindAddress: metricsAddr,
86+
WebhookServer: &webhook.Server{
87+
TLSOpts: tlsOpts,
88+
},
7189
Port: 9443,
7290
HealthProbeBindAddress: probeAddr,
7391
LeaderElection: enableLeaderElection,

‎testdata/project-v4-multigroup-with-deploy-image/cmd/main.go

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ limitations under the License.
1717
package main
1818

1919
import (
20+
"crypto/tls"
2021
"flag"
2122
"os"
2223

@@ -31,6 +32,7 @@ import (
3132
"sigs.k8s.io/controller-runtime/pkg/healthz"
3233
"sigs.k8s.io/controller-runtime/pkg/log/zap"
3334
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
35+
"sigs.k8s.io/controller-runtime/pkg/webhook"
3436

3537
crewv1 "sigs.k8s.io/kubebuilder/testdata/project-v4-multigroup-with-deploy-image/api/crew/v1"
3638
fizv1 "sigs.k8s.io/kubebuilder/testdata/project-v4-multigroup-with-deploy-image/api/fiz/v1"
@@ -78,11 +80,17 @@ func main() {
7880
var metricsAddr string
7981
var enableLeaderElection bool
8082
var probeAddr string
83+
var secureMetrics bool
84+
var enableHTTP2 bool
8185
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
8286
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
8387
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
8488
"Enable leader election for controller manager. "+
8589
"Enabling this will ensure there is only one active controller manager.")
90+
flag.BoolVar(&secureMetrics, "metrics-secure", false,
91+
"Whether or not the metrics endpoint should be served securely")
92+
flag.BoolVar(&enableHTTP2, "enable-http2", false,
93+
"Whether or not HTTP/2 should be enabled for the metrics and webhook servers")
8694
opts := zap.Options{
8795
Development: true,
8896
}
@@ -91,9 +99,28 @@ func main() {
9199

92100
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
93101

102+
disableHTTP2 := func(c *tls.Config) {
103+
setupLog.Info("disabling http/2")
104+
c.NextProtos = []string{"http/1.1"}
105+
}
106+
107+
tlsOpts := []func(*tls.Config){}
108+
if !enableHTTP2 {
109+
tlsOpts = append(tlsOpts, disableHTTP2)
110+
}
111+
112+
webhookServer := webhook.NewServer(webhook.Options{
113+
TLSOpts: tlsOpts,
114+
})
115+
94116
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
95-
Scheme: scheme,
96-
Metrics: metricsserver.Options{BindAddress: metricsAddr},
117+
Scheme: scheme,
118+
Metrics: metricsserver.Options{
119+
BindAddress: metricsAddr,
120+
SecureServing: secureMetrics,
121+
TLSOpts: tlsOpts,
122+
},
123+
WebhookServer: webhookServer,
97124
HealthProbeBindAddress: probeAddr,
98125
LeaderElection: enableLeaderElection,
99126
LeaderElectionID: "65c8a5ec.testproject.org",

‎testdata/project-v4-multigroup/cmd/main.go

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ limitations under the License.
1717
package main
1818

1919
import (
20+
"crypto/tls"
2021
"flag"
2122
"os"
2223

@@ -31,6 +32,7 @@ import (
3132
"sigs.k8s.io/controller-runtime/pkg/healthz"
3233
"sigs.k8s.io/controller-runtime/pkg/log/zap"
3334
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
35+
"sigs.k8s.io/controller-runtime/pkg/webhook"
3436

3537
crewv1 "sigs.k8s.io/kubebuilder/testdata/project-v4-multigroup/api/crew/v1"
3638
fizv1 "sigs.k8s.io/kubebuilder/testdata/project-v4-multigroup/api/fiz/v1"
@@ -78,11 +80,17 @@ func main() {
7880
var metricsAddr string
7981
var enableLeaderElection bool
8082
var probeAddr string
83+
var secureMetrics bool
84+
var enableHTTP2 bool
8185
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
8286
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
8387
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
8488
"Enable leader election for controller manager. "+
8589
"Enabling this will ensure there is only one active controller manager.")
90+
flag.BoolVar(&secureMetrics, "metrics-secure", false,
91+
"Whether or not the metrics endpoint should be served securely")
92+
flag.BoolVar(&enableHTTP2, "enable-http2", false,
93+
"Whether or not HTTP/2 should be enabled for the metrics and webhook servers")
8694
opts := zap.Options{
8795
Development: true,
8896
}
@@ -91,9 +99,28 @@ func main() {
9199

92100
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
93101

102+
disableHTTP2 := func(c *tls.Config) {
103+
setupLog.Info("disabling http/2")
104+
c.NextProtos = []string{"http/1.1"}
105+
}
106+
107+
tlsOpts := []func(*tls.Config){}
108+
if !enableHTTP2 {
109+
tlsOpts = append(tlsOpts, disableHTTP2)
110+
}
111+
112+
webhookServer := webhook.NewServer(webhook.Options{
113+
TLSOpts: tlsOpts,
114+
})
115+
94116
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
95-
Scheme: scheme,
96-
Metrics: metricsserver.Options{BindAddress: metricsAddr},
117+
Scheme: scheme,
118+
Metrics: metricsserver.Options{
119+
BindAddress: metricsAddr,
120+
SecureServing: secureMetrics,
121+
TLSOpts: tlsOpts,
122+
},
123+
WebhookServer: webhookServer,
97124
HealthProbeBindAddress: probeAddr,
98125
LeaderElection: enableLeaderElection,
99126
LeaderElectionID: "3e9f67a9.testproject.org",

0 commit comments

Comments
 (0)