spuru9 opened a new pull request, #1188:
URL: https://github.com/apache/flink-kubernetes-operator/pull/1188
## What is the purpose of the change
The operator validates a `FlinkSessionJob`'s `jarURI` host against the
restricted-host policy, but the subsequent HTTP fetch resolved the hostname
again when opening the connection. A hostname that passed validation could
therefore resolve to a different (e.g. internal) address at connect time — a
DNS-rebinding / TOCTOU gap.
This change resolves the host once during validation and pins the connection
to that resolved address for each redirect hop, so the address that was checked
is the address that is connected to. Split out of #1186 (FLINK-40402) per
review, as it is independent of the artifact-fetch timeout / size-limit work.
## Brief change log
- `JarUriValidationUtils#validateAndResolve` returns the resolved address
alongside the existing scheme / restricted-host validation.
- `HttpArtifactFetcher` connects to the resolved address (as an IP
literal) for each redirect hop instead of re-resolving the hostname.
- The original hostname is preserved for the `Host` request header and,
over HTTPS, for TLS SNI and certificate verification, so pinning does not break
virtual hosting or the TLS handshake.
## Verifying this change
This change added tests and can be verified as follows:
-
`ArtifactManagerTest#testHttpFetchPreservesOriginalHostnameWhenConnectingToPinnedAddress`
— asserts the original hostname is sent as the `Host` header while the
connection is pinned to the resolved address.
-
`ArtifactManagerTest#testHttpsFetchPinsAddressAndPreservesHostnameForTls` —
asserts HTTPS SNI / certificate verification use the original hostname (cert
SAN = `localhost`), not the pinned IP literal.
## Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): no
- The public API, i.e., is any changes to the `CustomResourceDescriptors`:
no
- Core observer or reconciler logic that is regularly executed: yes (the
artifact fetch performed during `FlinkSessionJob` reconciliation)
## Documentation
- Does this pull request introduce a new feature? no
- If yes, how is the feature documented? not applicable
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (Claude Code)
Generated-by: Claude Code
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
