@@ -81,6 +81,17 @@ type Options struct {
8181 // ControllerOptions encapsulates options for creating a new controller,
8282 // including throttling and stats behavior.
8383 ControllerOptions * controller.ControllerOptions
84+
85+ // EnableHTTP2 enables HTTP2 for webhooks.
86+ // Mitigate CVE-2023-44487 by disabling HTTP2 by default until the Go
87+ // standard library and golang.org/x/net are fully fixed.
88+ // Right now, it is possible for authenticated and unauthenticated users to
89+ // hold open HTTP2 connections and consume huge amounts of memory.
90+ // See:
91+ // * https://github.com/kubernetes/kubernetes/pull/121120
92+ // * https://github.com/kubernetes/kubernetes/issues/121197
93+ // * https://github.com/golang/go/issues/63417#issuecomment-1758858612
94+ EnableHTTP2 bool
8495}
8596
8697// Operation is the verb being operated on
@@ -245,12 +256,19 @@ func (wh *Webhook) Run(stop <-chan struct{}) error {
245256 QuietPeriod : wh .Options .GracePeriod ,
246257 }
247258
259+ // If TLSNextProto is not nil, HTTP/2 support is not enabled automatically.
260+ nextProto := map [string ]func (* http.Server , * tls.Conn , http.Handler ){}
261+ if wh .Options .EnableHTTP2 {
262+ nextProto = nil
263+ }
264+
248265 server := & http.Server {
249266 ErrorLog : log .New (& zapWrapper {logger }, "" , 0 ),
250267 Handler : drainer ,
251268 Addr : fmt .Sprint (":" , wh .Options .Port ),
252269 TLSConfig : wh .tlsConfig ,
253270 ReadHeaderTimeout : time .Minute , //https://medium.com/a-journey-with-go/go-understand-and-mitigate-slowloris-attack-711c1b1403f6
271+ TLSNextProto : nextProto ,
254272 }
255273
256274 var serve = server .ListenAndServe
0 commit comments