Kubernetes pod exec API exception: Response must not include 'Sec-WebSocket-Protocol' header if not present in request

问题

I am trying to setup a websocket connection to the Kubernetes Pod Exec API, based on the suggestions given in this SO post: How to execute command in a pod (kubernetes) using API?. Here's what I have done so far -

1. Installed Simple Web Socket Client extension in Chrome.
2. Started kubectl proxy --disable-filter=true to run proxy with WS connections allowed. kubectl.exe version is 1.8.
3. Used address ws://localhost:8001/api/v1/namespaces/default/pods/nginx-3580832997-26zcn/exec?container=nginx&stdin=1&stdout=1&stderr=1&tty=1&command=%2Fbin%2Fsh in the Chrome extension to connect to the exec api.

When I click connect, Chrome reports back an error with the message -

Error during WebSocket handshake: Response must not include 'Sec-WebSocket-Protocol' header if not present in request

Apparently, kubectl is sending back empty Sec-WebSocket-Protocol header in the response and Chrome is taking offense to that.

I tried changing the code of Simple Web Socket Client open method to send empty protocols parameter to the Websocket client creation call, like - ws = new WebSocket(url, []); to coax Chrome in sending empty header in request, but Chrome doesn't send empty header.

So what can be done to directly connect to the exec in Chrome?

回答1:

This is a known issue; kubectl proxy does not support websockets. (You can verify this easily by starting up kubectl proxy and then attempting kubectl --server=http://127.0.0.1:8001 exec ...; you will receive the message error: unable to upgrade connection: <h3>Unauthorized</h3> if the filter is enabled and Error from server (BadRequest): Upgrade request required if the filter is disabled).

The confusion might come from the fact that the kube-apiserver proxy does support websockets, but that proxy is different from the kubectl proxy.

As I see you have 3 options now (in order of difficulty):

• Access kube-apiserver directly. You will likely need authentication that kubectl proxy is handling for you now
• Use SockJS, this is what Kubernetes Dashboard does for the exec feature
• Fix #25126

回答2:

After reading the code in https://github.com/kubernetes-ui/container-terminal/blob/master/container-terminal.js, found that exec uses base64.channel.k8s.io protocol. The Simple Web Socket Client code wouldn't have worked because of this and also that the stream communication is in base64, not plain text.

Leaving this as an answer for other folks trying to implement a WS based terminal emulator... as @janos-lenart mentioned, the code is pretty new and there may be issues using it in different browsers, best bet at this point is to read example code and start from there.

来源：https://stackoverflow.com/questions/46968582/kubernetes-pod-exec-api-exception-response-must-not-include-sec-websocket-prot