Improved error when sending k8s traffic to the proxy's web port (#2918)

gravitational · Aug 12, 2019 · 08902c5 · 08902c5
1 parent f8b4282
commit 08902c5
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/lib/kube/proxy/forwarder.go b/lib/kube/proxy/forwarder.go
@@ -283,6 +283,8 @@ func (f *Forwarder) authenticate(req *http.Request) (*authContext, error) {
 
 	case auth.RemoteUser:
 		isRemoteUser = true
+	case auth.BuiltinRole:
+		f.Warningf("Denying proxy access to unauthenticated user of type %T - this can sometimes be caused by inadvertently sending Kubernetes traffic to the proxy's web port.", userTypeI)
 	default:
 		f.Warningf("Denying proxy access to unsupported user type: %T.", userTypeI)
 		return nil, trace.AccessDenied(accessDeniedMsg)