Description

• As all ksvc's metrics are exposed via autoscaler and controller svc, anyone can list all ksvc running on the cluster by hitting the svc endpoint.
• This is not a problem for single tenant k8s users, but it is problematic for multi tenant users.

Streps to produce

1. Run a pod in arbitrary namespace
2. Curl from the pod to controller's or autoscaller's metrics endpoint.

$ oc rsh <ANY POD> 
# curl controller.knative-serving.svc:9090/metrics
# curl autoscaler.knative-serving.svc:9090/metrics

Result

We can get the list of ksvc running on the cluster with the metrics info.

autoscaler_reconcile_latency_bucket{key="serving-tests/hello-example-bcwzf",reconciler="KPA-Class Autoscaling",success="true",le="10"}
autoscaler_reconcile_latency_bucket{key="default/hello-example-68zcn",reconciler="KPA-Class Autoscaling",success="true",le="100"}
...

Workaround

• Use  ovs-multitenant plugin's access controller feature. However, we still need accessibility between knative-serving ns and user's ns.
• Deploy knative serving on random namespace, though it is not possible with K-S-O.