reject unauthorized traffic from kalm route
@@ -7,6 +7,7 @@ import (
"github.com/kalmhq/kalm/api/auth"
"github.com/kalmhq/kalm/api/config"
"github.com/kalmhq/kalm/api/errors"
+ "github.com/kalmhq/kalm/controller/controllers"
"github.com/labstack/echo/v4"
"k8s.io/client-go/kubernetes"
"k8s.io/client-go/rest"
@@ -172,6 +173,11 @@ func (m *ClientManager) GetConfigForClientRequestContext(c echo.Context) (*Clien
return &clientInfo, nil
}
+ // reject traffic from route without valid authentication info
+ if c.Request().Header.Get(controllers.KALM_ROUTE_HEADER) == "true" {
+ return nil, errors.NewUnauthorized("")
+ }
+
// If the request is from localhost
// Case #1: localhost development
// Case #2: kubectl port-forwrd (https://github.com/kubernetes/kubernetes/blob/6ce9e71cd57d4aa6c932aabddf4129f173b9d710/pkg/kubelet/dockershim/docker_streaming_others.go#L31-L86)
