End to end tests for networking related items (routing, traffic split, timeouts, dns, etc)

[mdemirhan]

No end-to-end tests exist today.

[mdemirhan]

From a discussion with @tcnghia on Slack:

Nghia Tran [10:25]
is there a way to distinguish origin of requests? currently we exclude prober requests, made by the kubelet running on the node, from autoscaling by using the User-Agent that kubelet used: User-Agent=kube-proxy/{major_version}.{minor_version}. however, an external user may set the same header themselves
May be we could combine this check with a Host header check? Will it be ever possible for user requests to hit the backend with Host=""? Currently that won't happen since we use domain rule in the Ingress

Nghia Tran [10:33]
The impact such prober impersonation is that if we only have a single pod an attacker could overload such pod while avoiding autoscaling to kick in (since prober requests are excluding from autoscaling consideration). I guess one practical solution is to only exclude prober requests up to a certain QPS -- but that would be more complicated than a Host header check.

Mustafa [10:36]
Host header based routing we enable today should prevent this traffic passing ingress
Domain is a required field as well. We should be covered as things stand today.

Nghia Tran [10:39]
that sounds good to me

We should add a test that covers this scenario in the end-to-end tests as well.

[drewinglis]

Can you please be more explicit about what scenario you want an E2E test for?

[drewinglis]

As an aside, I think that (1) that implementation detail is likely to change (autoscaling metric collection is likely to change when we move from per-revision to multi-tenant autoscalers) and (2) a better solution for that attack vector would be to expose a separate port on the node that autoscaling and other health checks go through (that is not accessible from external traffic), and exclude traffic that way.

[mdemirhan]

@tcnghia for Drew's suggestions.
@drewinglis I meant an end to end test trying to send traffic with an empty host header and ensuring that it gets rejected.

[drewinglis]

@tcnghia if you want to discuss this further, please open a separate issue for it, so we can keep this one on-topic. (I apologize for starting to branch here. :))