Repository navigation
Proxy Kubernetes websocket streams that offer no subprotocol - #2832
Merged
Merged
Conversation
…adapter Allow exec/attach/port-forward clients to offer no subprotocol. Use the reqwest-websocket public client and request-builder traits to normalize only a single empty protocol response on 101 when no protocol was offered. The library continues to construct and validate the handshake and handle WebSocket frames through the existing authenticated HTTP/1.1 client. Negotiate upstream before replying downstream so both sides acknowledge the same selected protocol. Preserve started/rejected audit ordering and forward the cluster's refusal response. Cover the compatibility case through the full proxy, a compact protocol-boundary matrix, audit timing, and refusals. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: Codex <codex@openai.com>
Use Mutex::into_inner for Poem’s FnOnce callback instead of an optional socket and a duplicate-consumption error. Keep the adapter’s handshake validation and shorten its helper comments. Co-authored-by: Codex <codex@openai.com>
Trigger fresh PR checks after Docker Hub rate limits and timeouts stopped the previous runs. No source changes. Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Codex <codex@openai.com>
1 of 4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fixes for #2662
Description
Kubernetes websocket clients can omit
Sec-WebSocket-Protocol, but the proxy currently requires it. Kubernetes can also return an empty protocol header, whichreqwest-websocketrejects.Accept an empty offer. A small adapter removes a single empty response protocol header only when no protocol was offered and the upstream returned HTTP 101. The library continues to validate the handshake and frame the connection.
Negotiate upstream before replying downstream, echo the API server's selected protocol, preserve stream audit timing, and forward rejected upgrades. Poem's callback consumes the upstream socket once through
Mutex::into_inner.This overlaps with #2663 in the websocket handler; the second PR to merge will need a rebase.
Validation
git diff --checkpassed. Clippy reports warnings in unchanged code.AI Usage