Document `/logs` API for API server

[RichardoC]

What happened?

While experimenting with the following command, I spotted an API that's not documented in the API one pager, which doesn't conform to the schema I would expect (it's HTML, not JSON)

$ kubectl  get --raw / | grep logs
    "/logs",

$ kubectl  get --raw /logs
<pre>
<a href="acpid.log">acpid.log</a>
<a href="buildkitd.log">buildkitd.log</a>
<a href="cloud-init-output.log">cloud-init-output.log</a>
<a href="containerd.log">containerd.log</a>
<a href="containers/">containers/</a>
<a href="dmesg">dmesg</a>
<a href="lima-init.log">lima-init.log</a>
<a href="messages">messages</a>
<a href="openresty/">openresty/</a>
<a href="pods/">pods/</a>
<a href="rancher-desktop-guestagent.log">rancher-desktop-guestagent.log</a>
<a href="wtmp">wtmp</a>
</pre>

This should be documented, and preferably be json to conform to the other APIs exposed.

What did you expect to happen?

This API would be documented, especially since it's serving up all files from a specific file path and the API should present some sort of json list rather than a webpage.

How can we reproduce it (as minimally and precisely as possible)?

$ kubectl  get --raw / | grep logs
    "/logs",

$ kubectl  get --raw /logs
...

Anything else we need to know?

This is the root cause of rancher-sandbox/docs.rancherdesktop.io#136 and k3s-io/k3s#6709 as I didn't expect an undocumented file server API from kubernetes.

Kubernetes version

$ kubectl version
WARNING: This version information is deprecated and will be replaced with the output from kubectl version --short. Use --output=yaml|json to get the full version.
Client Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.4", GitCommit:"95ee5ab382d64cfe6c28967f36b53970b8374491", GitTreeState:"clean", BuildDate:"2022-08-17T18:54:23Z", GoVersion:"go1.18.5", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v4.5.4
Server Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.8+k3s1", GitCommit:"648004e4faeaf9e8705386342e95ec9bd211c2b8", GitTreeState:"clean", BuildDate:"2022-11-18T18:29:47Z", GoVersion:"go1.18.8", Compiler:"gc", Platform:"linux/amd64"}

Cloud provider

$ rdctl version rdctl client version: 1.1.0, targeting server version: v0 Rancher Desktop version 1.7.0 on Ubuntu 22.04.1 x64

OS version

Ubuntu 22.04.1

Install tools

No response

Container runtime (CRI) and version (if applicable)

No response

Related plugins (CNI, CSI, ...) and versions (if applicable)

No response

[k8s-ci-robot]

@RichardoC: This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[RichardoC]

/sig docs

[RichardoC]

For anyone seeing this in a panic, it is behind auth (thankfully)
A k3s maintainer found the code and details are in k3s-io/k3s#6709 (comment)

[brandond]

FYI, for CLI docs I usually check this page, not the api docs.

This has been deprecated since 1.15 as per kubernetes/kubernetes#77611 - I wonder if that's why it's omitted from the docs? It's still there, and still on by default though.

https://github.com/kubernetes/kubernetes/blob/804d6167111f6858541cef440ccc53887fbbc96a/cmd/kube-apiserver/app/options/options.go#L173-L175

https://github.com/kubernetes/kubernetes/blob/804d6167111f6858541cef440ccc53887fbbc96a/cmd/kube-apiserver/app/options/options.go#L113

[brandond]

/cc @dims @liggitt @cheftako

[brandond]

Funny enough the original report that triggered that PR was also against k3s:

• Directory traversal vulnerability k3s-io/k3s#387
  so this is probably considered a duplicate of:
• Directory traversal (or path traversal)? kubernetes#77182

[RichardoC]

FYI, for CLI docs I usually check this page, not the api docs.

This has been deprecated since 1.15 as per kubernetes/kubernetes#77611 - I wonder if that's why it's omitted from the docs? It's still there, and still on by default though.

https://github.com/kubernetes/kubernetes/blob/804d6167111f6858541cef440ccc53887fbbc96a/cmd/kube-apiserver/app/options/options.go#L173-L175

https://github.com/kubernetes/kubernetes/blob/804d6167111f6858541cef440ccc53887fbbc96a/cmd/kube-apiserver/app/options/options.go#L113

While it's a CLI option, the fact it's accessible via the rest API means I'd expect it to be documented there. If it was on another port I'd agree with you

[liggitt]

I'm not sure how https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/ is generated, but the logs endpoint is included in the openapi reference when enabled:

    "/logs/": {
      "get": {
        "operationId": "logFileListHandler",
        "responses": {
          "401": {
            "description": "Unauthorized"
          }
        },
        "schemes": [
          "https"
        ],
        "tags": [
          "logs"
        ]
      }
    },
    "/logs/{logpath}": {
      "get": {
        "operationId": "logFileHandler",
        "responses": {
          "401": {
            "description": "Unauthorized"
          }
        },
        "schemes": [
          "https"
        ],
        "tags": [
          "logs"
        ]
      },
      "parameters": [
        {
          "description": "path to the log",
          "in": "path",
          "name": "logpath",
          "required": true,
          "type": "string",
          "uniqueItems": true
        }
      ]
    },

/transfer website

[sftim]

/kind feature
/language en
/retitle Document hidden /logs API for API server
/sig security
/sig api-machinery