-
Bug
-
Resolution: Won't Do
-
Normal
-
None
-
4.13, 4.12, 4.14
-
Quality / Stability / Reliability
-
False
-
-
None
-
Moderate
-
No
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
Setting --goaway-chance=0.001 helps to mitigate authenticated HTTP/2 DoS attacks on the kube apiserver. This is similar to how the `UnauthenticatedHTTP2DOSMitigation` feature flag helps to mitigated unauthenticated attacks. This flag is currently not configurable and set to 0.
Version-Release number of selected component (if applicable):
All releases
How reproducible:
Steps to Reproduce:
1. git clone git@github.com:secengjeff/rapidresetclient.git
2. cd rapidresetclient
3. go build -o rapidresetclient
4. BASE_URL=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
5. ./rapidresetclient -url "${BASE_URL}/livez/ping" -wait=100 -delay=10 -requests=10000 -concurrency=100
Actual results:
Runs forever
Expected results:
Eventually hits broken pipe errors
Additional info:
