HTTP listener: default disabled and may only bind to loopback interfaces

deploy/supervisor/deployment.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
@@ -115,8 +115,6 @@ spec:
               readOnly: false  #! writable to allow for socket use
             #@ end
           ports:
-            - containerPort: 8080
-              protocol: TCP
             - containerPort: 8443
               protocol: TCP
           env:

deploy/supervisor/values.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@data/values
@@ -74,17 +74,17 @@ api_group_suffix: pinniped.dev
 https_proxy: #! e.g. http://proxy.example.com
 no_proxy: "$(KUBERNETES_SERVICE_HOST),169.254.169.254,127.0.0.1,localhost,.svc,.cluster.local" #! do not proxy Kubernetes endpoints
 
-#! Control the https and http listeners of the Supervisor.
+#! Control the HTTP and HTTPS listeners of the Supervisor.
 #!
 #! The schema of this config is as follows:
 #!
 #! endpoints:
 #!   https:
 #!     network: tcp | unix | disabled
-#!     address: interface:port when network=tcp or /pinniped_socket/socketfile.sock when network=unix
+#!     address: host:port when network=tcp or /pinniped_socket/socketfile.sock when network=unix
 #!   http:
 #!     network: same as above
-#!     address: same as above
+#!     address: same as above, except that when network=tcp then the address is only allowed to bind to loopback interfaces
 #!
 #! Setting network to disabled turns off that particular listener.
 #! See https://pkg.go.dev/net#Listen and https://pkg.go.dev/net#Dial for a description of what can be
@@ -98,23 +98,20 @@ no_proxy: "$(KUBERNETES_SERVICE_HOST),169.254.169.254,127.0.0.1,localhost,.svc,.
 #!     network: tcp
 #!     address: :8443
 #!   http:
-#!     network: tcp
-#!     address: :8080
+#!     network: disabled
 #!
-#! These defaults mean: bind to all interfaces using TCP.  Use port 8443 for https and 8080 for http.
-#! The defaults will change over time.  Users should explicitly set this value if they wish to avoid
-#! any changes on upgrade.
+#! These defaults mean: For HTTPS listening, bind to all interfaces using TCP on port 8443.
+#! Disable HTTP listening by default.
 #!
-#! A future version of the Supervisor app may include a breaking change to adjust the default
-#! behavior of the http listener to only listen on 127.0.0.1 (or perhaps even to be disabled).
+#! The HTTP listener can only be bound to loopback interfaces. This allows the listener to accept
+#! traffic from within the pod, e.g. from a service mesh sidecar. The HTTP listener should not be
+#! used to accept traffic from outside the pod, since that would mean that the network traffic could be
+#! transmitted unencrypted. The HTTPS listener should be used instead to accept traffic from outside the pod.
+#! Ingresses and load balancers that terminate TLS connections should re-encrypt the data and route traffic
+#! to the HTTPS listener. Unix domain sockets may also be used for integrations with service meshes.
 #!
-#! Binding the http listener to addresses other than 127.0.0.1 or ::1 is deprecated.
-#!
-#! Unix domain sockets are recommended for integrations with service meshes.  Ingresses that terminate
-#! TLS connections at the edge should re-encrypt the data and route traffic to the https listener.
-#!
-#! Changing the port numbers used must be accompanied with matching changes to the service and deployment
-#! manifests.  Changes to the https listener must be coordinated with the deployment health checks.
+#! Changing the HTTPS port number must be accompanied by matching changes to the service and deployment
+#! manifests. Changes to the HTTPS listener must be coordinated with the deployment health checks.
 #!
 #! Optional.
 endpoints: