hanzo-ml/spark-operator
1
0
Fork 0
mirror of https://github.com/hanzo-ml/spark-operator.git synced 2026-07-27 06:55:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: always set NextProtos regardless of enableHTTP2 flag (#2990)

Browse Source 
Both branches of the enableHTTP2 conditional in SetupTLS() were setting
the same NextProtos value ["h2", "http/1.1"], making the conditional
dead code. Remove it and always set NextProtos unconditionally.

Also remove the enableHTTP2 CLI flag, variable, and parameter from
controller and webhook start commands. The flag was a workaround for
CVE-2023-44487 (HTTP/2 rapid reset) which is fixed in Go 1.21.3+.
A user-facing flag that silently does nothing is misleading.

Signed-off-by: Ugo Giordano <ugiordan@redhat.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ugo Giordano
2026-06-25 16:57:00 +00:00
committed by GitHub
co-authored by Claude Opus 4.6
parent 2a6b2224dc
commit 26a0cfadd2
3 changed files with 6 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/operator/controller/start.go
+1 -3
View File
@@ -128,7 +128,6 @@ var (
healthProbeBindAddress string
pprofBindAddress string
secureMetrics bool
enableHTTP2 bool
tlsMinVersion string
tlsCipherSuites []string
scheduledSparkApplicationTimestampPrecision string
@@ -238,7 +237,6 @@ func NewStartCommand() *cobra.Command {
command.Flags().StringVar(&healthProbeBindAddress, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
command.Flags().BoolVar(&secureMetrics, "secure-metrics", false, "If set the metrics endpoint is served securely")
command.Flags().BoolVar(&enableHTTP2, "enable-http2", false, "If set, HTTP/2 will be enabled for the metrics and webhook servers")
command.Flags().StringVar(&tlsMinVersion, "metric-tls-min-version", "VersionTLS12",
"Minimum TLS version for the metrics server. "+
"Possible values: VersionTLS12, VersionTLS13")
@@ -288,7 +286,7 @@ func start() {
cfg.Burst = kubeAPIBurst
// Create the manager.
tlsOptions, err := operatortls.SetupTLS(tlsMinVersion, tlsCipherSuites, enableHTTP2)
tlsOptions, err := operatortls.SetupTLS(tlsMinVersion, tlsCipherSuites)
if err != nil {
logger.Error(err, "Failed to set up TLS")
os.Exit(1)
cmd/operator/webhook/start.go
+1 -3
View File
@@ -108,7 +108,6 @@ var (
healthProbeBindAddress string
secureMetrics bool
enableHTTP2 bool
tlsMinVersion string
tlsCipherSuites []string
development bool
@@ -173,7 +172,6 @@ func NewStartCommand() *cobra.Command {
command.Flags().StringVar(&healthProbeBindAddress, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
command.Flags().BoolVar(&secureMetrics, "secure-metrics", false, "If set the metrics endpoint is served securely")
command.Flags().BoolVar(&enableHTTP2, "enable-http2", false, "If set, HTTP/2 will be enabled for the metrics and webhook servers")
command.Flags().StringVar(&tlsMinVersion, "webhook-tls-min-version", "VersionTLS12",
"Minimum TLS version for the webhook and metrics servers. "+
"Possible values: VersionTLS12, VersionTLS13")
@@ -204,7 +202,7 @@ func start() {
cfg.Burst = kubeAPIBurst
// Create the manager.
tlsOptions, err := operatortls.SetupTLS(tlsMinVersion, tlsCipherSuites, enableHTTP2)
tlsOptions, err := operatortls.SetupTLS(tlsMinVersion, tlsCipherSuites)
if err != nil {
logger.Error(err, "Failed to set up TLS")
os.Exit(1)
pkg/tls/tls.go
+4 -10
View File
@@ -23,7 +23,7 @@ import (
)
// SetupTLS parses the TLS flags and returns TLS option functions for webhook and metrics servers.
func SetupTLS(minVersion string, cipherSuites []string, enableHTTP2 bool) ([]func(*cryptotls.Config), error) {
func SetupTLS(minVersion string, cipherSuites []string) ([]func(*cryptotls.Config), error) {
var tlsOpts []func(*cryptotls.Config)
ver, err := ParseTLSVersion(minVersion)
@@ -44,15 +44,9 @@ func SetupTLS(minVersion string, cipherSuites []string, enableHTTP2 bool) ([]fun
})
}
if enableHTTP2 {
tlsOpts = append(tlsOpts, func(c *cryptotls.Config) {
c.NextProtos = []string{"h2", "http/1.1"}
})
} else {
tlsOpts = append(tlsOpts, func(c *cryptotls.Config) {
c.NextProtos = []string{"h2", "http/1.1"}
})
}
tlsOpts = append(tlsOpts, func(c *cryptotls.Config) {
c.NextProtos = []string{"h2", "http/1.1"}
})
return tlsOpts, nil
}