Set a 5-minutes ReadHeaderTimeout for client http.Server

[ahrtr]

Resolve a security noise(see below) with low cost. Normally client-server communication is protected by mTLS, this shouldn't be a problem.

An unauthenticated network attacker can hold open many partial-header HTTP/1.1 connections to the etcd client listener until the LimitListener fd cap (fdLimit-150) is exhausted, denying service to legitimate etcd clients. The etcd server process is affected; availability of the client API is the impacted resource.

Note, we use the same value as peer http.Server,

etcd/server/embed/etcd.go

Line 602 in 81e09b0

ReadTimeout: 5 * time.Minute,

cc @fuweid @ivanvc @serathius

[ahrtr]

/test pull-etcd-robustness-amd64

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.65%. Comparing base (81e09b0) to head (0e3027b).

Additional details and impacted files

Files with missing lines	Coverage Δ
server/embed/serve.go	59.25% <100.00%> (+0.27%)	⬆️

... and 23 files with indirect coverage changes

@@            Coverage Diff             @@
##             main   #22128      +/-   ##
==========================================
- Coverage   69.66%   69.65%   -0.02%     
==========================================
  Files         449      449              
  Lines       38177    38179       +2     
==========================================
- Hits        26597    26593       -4     
- Misses      10148    10152       +4     
- Partials     1432     1434       +2     

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 81e09b0...0e3027b. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ahrtr, fuweid

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ahrtr,fuweid]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ahrtr]

/cherry-pick release-3.7

[ahrtr]

/cherry-pick release-3.6

[k8s-infra-cherrypick-robot]

@ahrtr: new pull request created: #22143

Details

In response to this:

/cherry-pick release-3.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-infra-cherrypick-robot]

@ahrtr: new pull request created: #22144

Details

In response to this:

/cherry-pick release-3.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ahrtr]

/cherry-pick release-3.5

[k8s-infra-cherrypick-robot]

@ahrtr: new pull request created: #22163

Details

In response to this:

/cherry-pick release-3.5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[brandond]

Same question as #22130 (comment), for servers where TLS is not enabled.