diff --git a/metadata-proxy/Dockerfile b/metadata-proxy/Dockerfile deleted file mode 100644 index 0bc0161a54..0000000000 --- a/metadata-proxy/Dockerfile +++ /dev/null @@ -1,25 +0,0 @@ -# Copyright 2017 The Kubernetes Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -FROM gcr.io/google-containers/debian-base-amd64:0.1 -LABEL maintainer "ihmccreery@google.com" - -ARG DEBIAN_FRONTEND=noninteractive -RUN apt-get update && apt-get install -y \ - apt-utils && clean-install iptables nginx - -# Place our wrapper script into the image. -COPY start-proxy.sh / - -ENTRYPOINT ["/start-proxy.sh"] diff --git a/metadata-proxy/Makefile b/metadata-proxy/Makefile deleted file mode 100644 index b70dddfe4b..0000000000 --- a/metadata-proxy/Makefile +++ /dev/null @@ -1,28 +0,0 @@ -# Copyright 2017 The Kubernetes Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -.PHONY: build push - -# TAG is the version to build and push to. -PREFIX = gcr.io/google-containers -TAG = 0.1.3 - -build: - # We explicitly add "--pull" flag to always fetch the latest version - # of the base image. This is necessary to avoid using cached local - # versions of image e.g. when updating insecure base images. - docker build --pull -t ${PREFIX}/metadata-proxy:$(TAG) . - -push: build - gcloud docker -- push ${PREFIX}/metadata-proxy:$(TAG) diff --git a/metadata-proxy/OWNERS b/metadata-proxy/OWNERS deleted file mode 100644 index 69c3a0d912..0000000000 --- a/metadata-proxy/OWNERS +++ /dev/null @@ -1,8 +0,0 @@ -approvers: -- ihmccreery -- cjcullen -- destijl -reviewers: -- ihmccreery -- cjcullen -- destijl diff --git a/metadata-proxy/README.md b/metadata-proxy/README.md new file mode 100644 index 0000000000..a25c768469 --- /dev/null +++ b/metadata-proxy/README.md @@ -0,0 +1 @@ +This project has moved to github.com/GoogleCloudPlatform/k8s-metadata-proxy. diff --git a/metadata-proxy/start-proxy.sh b/metadata-proxy/start-proxy.sh deleted file mode 100755 index 5da270ecad..0000000000 --- a/metadata-proxy/start-proxy.sh +++ /dev/null @@ -1,31 +0,0 @@ -#!/bin/dash - -# Copyright 2017 The Kubernetes Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -_term() { - iptables -D -t filter -I KUBE-METADATA-SERVER -j ACCEPT - iptables -D -t nat -I PREROUTING -p tcp -d 169.254.169.254 --dport 80 -j DNAT --to-destination 127.0.0.1:988 - exit -} - -# Forward traffic to nginx. -iptables -t nat -I PREROUTING -p tcp -d 169.254.169.254 --dport 80 -j DNAT --to-destination 127.0.0.1:988 -iptables -t filter -I KUBE-METADATA-SERVER -j ACCEPT - -# Clean up the iptables rule if we're exiting gracefully. -trap _term TERM - -# Run nginx in the foreground. -nginx -g 'daemon off;' diff --git a/metadata-proxy/test/Dockerfile b/metadata-proxy/test/Dockerfile deleted file mode 100644 index 79bd9dde97..0000000000 --- a/metadata-proxy/test/Dockerfile +++ /dev/null @@ -1,19 +0,0 @@ -# Copyright 2016 The Kubernetes Authors. All rights reserved -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -FROM busybox - -COPY check_metadata_concealment / - -ENTRYPOINT ["/check_metadata_concealment"] diff --git a/metadata-proxy/test/Godeps/Godeps.json b/metadata-proxy/test/Godeps/Godeps.json deleted file mode 100644 index 97a729dae4..0000000000 --- a/metadata-proxy/test/Godeps/Godeps.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "ImportPath": "k8s.io/contrib/metadata-proxy/tmp", - "GoVersion": "go1.9", - "GodepVersion": "v79", - "Deps": [] -} diff --git a/metadata-proxy/test/Godeps/Readme b/metadata-proxy/test/Godeps/Readme deleted file mode 100644 index 4cdaa53d56..0000000000 --- a/metadata-proxy/test/Godeps/Readme +++ /dev/null @@ -1,5 +0,0 @@ -This directory tree is generated automatically by godep. - -Please do not edit. - -See https://github.com/tools/godep for more information. diff --git a/metadata-proxy/test/Makefile b/metadata-proxy/test/Makefile deleted file mode 100644 index 4863f5825d..0000000000 --- a/metadata-proxy/test/Makefile +++ /dev/null @@ -1,38 +0,0 @@ -# Copyright 2016 The Kubernetes Authors. All rights reserved -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -all: build - -FLAGS = -ENVVAR = GOOS=linux GOARCH=amd64 CGO_ENABLED=0 -REGISTRY = gcr.io/google_containers -TAG = v0.0.1 - -deps: - go get github.com/tools/godep - -build: clean deps - $(ENVVAR) godep go build ./... - $(ENVVAR) godep go build -o check_metadata_concealment - -container: build - docker build --pull -t ${REGISTRY}/check-metadata-concealment:$(TAG) . - -push: container - gcloud docker -- push ${REGISTRY}/check-metadata-concealment:$(TAG) - -clean: - rm -f check_metadata_concealment - -.PHONY: all deps build container push clean diff --git a/metadata-proxy/test/check-metadata-concealment.yaml b/metadata-proxy/test/check-metadata-concealment.yaml deleted file mode 100644 index b5773ae765..0000000000 --- a/metadata-proxy/test/check-metadata-concealment.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: batch/v1 -kind: Job -metadata: - name: check-metadata-concealment -spec: - template: - metadata: - name: check-metadata-concealment - spec: - containers: - - name: check-metadata-concealment - image: gcr.io/google_containers/check-metadata-concealment:v0.0.1 - imagePullPolicy: Always - restartPolicy: Never diff --git a/metadata-proxy/test/check_metadata_concealment.go b/metadata-proxy/test/check_metadata_concealment.go deleted file mode 100644 index ab7436d750..0000000000 --- a/metadata-proxy/test/check_metadata_concealment.go +++ /dev/null @@ -1,126 +0,0 @@ -/* -Copyright 2017 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package main - -import ( - "fmt" - "io/ioutil" - "log" - "net/http" - "os" - "regexp" -) - -var ( - successEndpoints = []string{ - // Root, no trailing slash. - "http://169.254.169.254", - "http://metadata.google.internal", - "http://169.254.169.254/", - "http://metadata.google.internal/", - // The GCE metadata server serves 301s for directory locations - // without trailing slashes. - "http://metadata.google.internal/0.1/meta-data", - "http://metadata.google.internal/computeMetadata/v1", - "http://metadata.google.internal/computeMetadata/v1beta1", - // Allowed API versions. - "http://metadata.google.internal/0.1/meta-data/", - "http://metadata.google.internal/computeMetadata/v1/", - "http://metadata.google.internal/computeMetadata/v1beta1/", - // Service account token endpoints. - "http://metadata.google.internal/0.1/meta-data/service-accounts/default/acquire", - "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token", - // Params that contain 'recursive' as substring. - "http://metadata.google.internal/computeMetadata/v1/instance/?nonrecursive=true", - "http://metadata.google.internal/computeMetadata/v1/instance/?something=other&nonrecursive=true", - } - noKubeEnvEndpoints = []string{ - // Check that these don't get a recursive result. - "http://metadata.google.internal/computeMetadata/v1/instance/?recursive%3Dtrue", // urlencoded - "http://metadata.google.internal/computeMetadata/v1/instance/?re%08ecursive=true", // backspaced - } - failureEndpoints = []string{ - // Other API versions. - "http://metadata.google.internal/0.2/", - "http://metadata.google.internal/computeMetadata/v2", - // kube-env. - "http://metadata.google.internal/computeMetadata/v1/instance/attributes/kube-env", - // VM identity. - "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity", - // Recursive, case-insensitive. - "http://metadata.google.internal/computeMetadata/v1/instance/?recursive=true", - "http://metadata.google.internal/computeMetadata/v1/instance/?RECURSIVE=ON", - "http://metadata.google.internal/computeMetadata/v1/instance/?something=other&recursive=true", - "http://metadata.google.internal/computeMetadata/v1/instance/?recursive=true&something=other", - } -) - -func main() { - success := 0 - for _, e := range successEndpoints { - if err := checkURL(e, 200, ""); err != nil { - log.Printf("Wrong response for %v: %v", e, err) - success = 1 - } - } - for _, e := range noKubeEnvEndpoints { - if err := checkURL(e, 200, "kube-env"); err != nil { - log.Printf("Wrong response for %v: %v", e, err) - success = 1 - } - } - for _, e := range failureEndpoints { - if err := checkURL(e, 403, ""); err != nil { - log.Printf("Wrong response for %v: %v", e, err) - success = 1 - } - } - os.Exit(success) -} - -// Checks that a URL returns the right code, and if s is non-empty, -// checks that the body doesn't contain s. -func checkURL(url string, expectedStatus int, s string) error { - client := &http.Client{} - req, err := http.NewRequest("GET", url, nil) - if err != nil { - return err - } - req.Header.Add("Metadata-Flavor", "Google") - resp, err := client.Do(req) - if err != nil { - return err - } - defer resp.Body.Close() - if resp.StatusCode != expectedStatus { - return fmt.Errorf("unexpected response: got %d, want %d", resp.StatusCode, expectedStatus) - } - body, err := ioutil.ReadAll(resp.Body) - if err != nil { - return err - } - if s != "" { - matched, err := regexp.Match(s, body) - if err != nil { - return err - } - if matched { - return fmt.Errorf("body incorrectly contained %q: got %v", s, string(body)) - } - } - return nil -}