Module streaming_server 

The streaming server of exec, attach and port forward sessions: the URLs with their one time tokens and the HTTP server their clients connect to.

Modules

attach 🔒

Attach sessions, which connect their client to the container process.

bounded_map 🔒

The tokens of the streaming sessions which wait for their clients, bounded in age and number.

budget 🔒

The bytes a streaming connection holds for the client. The streaming protocols have no flow control, so a connection bounds what it buffers for all of its streams together and stops reading the client once that is used up. The data gives its share back once it got taken.

channel 🔒

The channel framing of the Kubernetes WebSocket protocols, which exec, attach and port forwarding share: every message starts with its channel, base64 protocols send text messages with the channel as an ASCII digit offset and the payload base64 encoded.

exec 🔒

Exec sessions, which start a process in the container for their client.

handshake 🔒

The upgrade of a request to a WebSocket or to SPDY, by the protocols the client asks for.

idle 🔒

The idle timeout of streaming connections.

port_forward 🔒

Port forwarding into the network namespace of a pod, the Kubernetes portforward.k8s.io protocol, as k8s.io/cri-streaming serves it for CRI-O otherwise.

remotecommand 🔒

The Kubernetes remote command protocols of exec and attach sessions, as k8s.io/cri-streaming serves them for CRI-O otherwise.

session 🔒

What exec and attach sessions share: the connection to the client, its input and the final status.

spdy 🔒

A SPDY/3.1 server for the streaming protocols of Kubernetes. The kubelet proxies the upgrade of a client to the streaming server of a container runtime unchanged. kubectl still arrives with SPDY when it connected with a WebSocket, the API server translates its v5.channel.k8s.io and port forwarding WebSockets to SPDY.

stream_protocol 🔒

What the streaming protocols of Kubernetes share between exec, attach and port forwarding, whatever the transport.

web 🔒

The HTTP side of the streaming server on top of hyper: short responses and the upgrade of a request to a WebSocket. The WebSocket handshake checks the request like RFC 6455 says, a request which does not pass gets a plain text response which tells what is missing.

Structs

SessionCommon 🔒

What the exec and attach sessions have in common.

State 🔒

State handled by the streaming server, the sessions waiting for their client by token. Never locked across an await.

StreamingServer 🔒

Serves the exec, attach and port forward sessions over HTTP on the loopback address, each under a one time URL, see StreamingServer::exec_url.

Enums

Session 🔒

A dedicated session for each provided functionality. Not Debug, the command of an exec may carry secrets.

Constants

ADDR 🔒

ATTACH_PATH 🔒

EXEC_PATH 🔒

HEADER_READ_TIMEOUT 🔒

How long a client may take to send the head of its request, which only applies with a timer. A connection which never sends one would stay open otherwise. Clients send it right after they connected, and every connection serves one request, see MAX_CONNECTIONS. Far below the 30 seconds of hyper, so that a connection without a request holds its permit for a short time only. That does not bound how long a local process can hold the server off: one which keeps opening connections, holds all permits and keeps the backlog of the listener full makes the connection of another client wait behind its own ones, a few times UPGRADE_TIMEOUT, or get its handshake dropped and retried while the backlog is full, for as long as it keeps that up. It cannot use up the file descriptors of the server.

MAX_CONNECTIONS 🔒

The most connections which did not get upgraded yet. More wait to be accepted, so that local processes which open connections without a request cannot use up the descriptors the whole pod needs. Upgraded connections do not count, their tokens bound them. There is no limit per peer, the server listens on the loopback address only, where the kubelet and a local process which holds connections look the same.

MAX_HEADER_BUF_SIZE 🔒

The most a connection buffers of the head of its request, the request line and the headers, see MAX_CONNECTIONS. A longer one gets a 431 response. hyper takes about 400 KiB otherwise, which lets local processes make the server hold about 100 MiB without a token. The kubelet sends the headers of the client and its own, a few KiB, Go servers take up to 1 MiB by default, nginx 32 KiB.

MAX_MESSAGE_SIZE 🔒

The largest WebSocket message and frame a client of exec or attach may send. Clients send stdin, which kubectl reads in 32 KiB chunks and the attach sockets take in packets of up to 33 KiB, and small resize events. The Python client sends all stdin of a write in one message, 1 MiB at a time for k8s_cp of Ansible, a third more in base64. The defaults of 64 MiB per message, or the 32 MiB of Kubernetes, would let a client make the server buffer that much per message. A client which sends more fails its session with a status and a close which tell why.

PORT_FORWARD_MAX_MESSAGE_SIZE 🔒

The largest WebSocket message and frame a client of port forwarding may send. A single message must not carry more than a connection takes while it gets established, the CONNECT_BUFFER of port_forward, nor all that the ports of a WebSocket hold together, its CHANNEL_BUFFER. A client which sends more gets the WebSocket closed with a code which tells why.

PORT_FORWARD_PATH 🔒

SWEEP_INTERVAL 🔒

How often the sessions whose client did not come in time get dropped, while sessions wait.

TOO_MANY_REQUESTS 🔒

The error of a request for a URL while too many of its kind wait for their client. Clients match it, see ErrTooManyRequests of the Go client, so it has to stay the start of the message.

UPGRADE_TIMEOUT 🔒

How long a connection may take until it got upgraded, also one which does not read its response. Clients make one upgrade request per connection, hyper has no timeout for writing the response.