Fix preview tool connection error and enforce read-only mode#7592
Merged
Conversation
This change ensures that the preview tool uses a valid REST config for the manager, resolving the 'connection refused' error on localhost:80. It also implements a read-only transport wrapper on a copy of the config to prevent accidental mutations. Fixes GoogleCloudPlatform#7589
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: cheftako, justinsb The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Merged
via the queue into
GoogleCloudPlatform:master
with commit Apr 15, 2026
1b086f7
169 checks passed
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Apr 16, 2026
### Description
This PR unskips `TestPreview` in `pkg/cli/preview/preview_test.go`.
### Key Changes
- Removed `t.Skip("Skipping flaky test")` from `TestPreview`.
### Dependencies
This PR depends on #7592 to fix the connection error in the preview
tool.
anhdle-sso
added a commit
that referenced
this pull request
Apr 21, 2026
….149 (#7642) Cherry pick #7592 to branch release-1.149. This PR fixes a connection error in the KCC preview tool and enforces read-only access to the cluster for security. ### Key Changes - **Manager Config**: Modified `pkg/cli/preview/preview.go` to pass `i.hookKube.upstreamRestConfig` to `kccmanager.New`. Previously, it was using an empty or invalid config in some code paths, which caused `apiReader` to default to `localhost:80` and fail with connection refused when reading `ConfigConnector` resources. - **Read-Only Transport**: Implemented a custom `readOnlyTransport` that wraps the `rest.Config` transport. This ensures that any non-GET/HEAD/OPTIONS request made via this config is immediately rejected with a 403 Forbidden at the network level. - **Isolation**: Used `rest.CopyConfig` to create a dedicated read-only configuration, ensuring the original `upstreamRESTConfig` remains untouched for other components. - **Debug Logging**: Added a log line to print the host of the REST config before creating the manager to help diagnose any future connection issues. Fixes #7589
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes a connection error in the KCC preview tool and enforces read-only access to the cluster for security.
Key Changes
pkg/cli/preview/preview.goto passi.hookKube.upstreamRestConfigtokccmanager.New. Previously, it was using an empty or invalid config in some code paths, which causedapiReaderto default tolocalhost:80and fail with connection refused when readingConfigConnectorresources.readOnlyTransportthat wraps therest.Configtransport. This ensures that any non-GET/HEAD/OPTIONS request made via this config is immediately rejected with a 403 Forbidden at the network level.rest.CopyConfigto create a dedicated read-only configuration, ensuring the originalupstreamRESTConfigremains untouched for other components.Fixes #7589