Change:
// TODO convert this entire proxy to an UpgradeAwareProxy similar to // https://github.com/openshift/origin/blob/master/pkg/util/httpproxy/upgradeawareproxy.go. // That proxy needs to be modified to support multiple backends, not just 1. <ins> if r.tryUpgrade(w, req, newReq, destURL) { return } proxy := httputil.NewSingleHostReverseProxy(&url.URL{Scheme: "http", Host: destURL.Host}) proxy.Transport = &proxyTransport{ proxyScheme:      req.URL.Scheme, proxyHost:        req.URL.Host, proxyPathPrepend: requestInfo.URLPath(), } proxy.FlushInterval = 200 * time.Millisecond proxy.ServeHTTP(w, newReq) } // tryUpgrade returns true if the request was handled. func (r *ProxyHandler) tryUpgrade(w http.ResponseWriter, req, newReq *http.Request, destURL *url.URL) bool { </ins> connectionHeader := strings.ToLower(req.Header.Get(httpstream.HeaderConnection)) <del> if strings.Contains(connectionHeader, strings.ToLower(httpstream.HeaderUpgrade)) && len(req.Header.Get(httpstream.HeaderUpgrade)) > 0 { //TODO support TLS? Doesn't look like proxyTransport does anything special ... dialAddr := netutil.CanonicalAddr(destURL) backendConn, err := net.Dial("tcp", dialAddr) if err != nil { status := errToAPIStatus(err) writeJSON(status.Code, r.codec, status, w) return } defer backendConn.Close() </del> <ins> if !strings.Contains(connectionHeader, strings.ToLower(httpstream.HeaderUpgrade)) || len(req.Header.Get(httpstream.HeaderUpgrade)) == 0 { return false } //TODO support TLS? Doesn't look like proxyTransport does anything special ... dialAddr := netutil.CanonicalAddr(destURL) backendConn, err := net.Dial("tcp", dialAddr) if err != nil { status := errToAPIStatus(err) writeJSON(status.Code, r.codec, status, w) return true } defer backendConn.Close() </ins> <del> // TODO should we use _ (a bufio.ReadWriter) instead of requestHijackedConn // when copying between the client and the backend? Docker doesn't when they // hijack, just for reference... requestHijackedConn, _, err := w.(http.Hijacker).Hijack() if err != nil { status := errToAPIStatus(err) writeJSON(status.Code, r.codec, status, w) return } defer requestHijackedConn.Close() </del> <ins> // TODO should we use _ (a bufio.ReadWriter) instead of requestHijackedConn // when copying between the client and the backend? Docker doesn't when they // hijack, just for reference... requestHijackedConn, _, err := w.(http.Hijacker).Hijack() if err != nil { status := errToAPIStatus(err) writeJSON(status.Code, r.codec, status, w) return true } defer requestHijackedConn.Close() </ins> <del> if err = newReq.Write(backendConn); err != nil { status := errToAPIStatus(err) writeJSON(status.Code, r.codec, status, w) return </del> <ins> if err = newReq.Write(backendConn); err != nil { status := errToAPIStatus(err) writeJSON(status.Code, r.codec, status, w) return true } done := make(chan struct{}, 2) go func() { _, err := io.Copy(backendConn, requestHijackedConn) if err != nil && !strings.Contains(err.Error(), "use of closed network connection") { glog.Errorf("Error proxying data from client to backend: %v", err) </ins> } <ins> done <- struct{}{} }() </ins> <del> done := make(chan struct{}, 2) go func() { _, err := io.Copy(backendConn, requestHijackedConn) if err != nil && !strings.Contains(err.Error(), "use of closed network connection") { glog.Errorf("Error proxying data from client to backend: %v", err) } done <- struct{}{} }() go func() { _, err := io.Copy(requestHijackedConn, backendConn) if err != nil && !strings.Contains(err.Error(), "use of closed network connection") { glog.Errorf("Error proxying data from backend to client: %v", err) } done <- struct{}{} }() <-done } else { proxy := httputil.NewSingleHostReverseProxy(&url.URL{Scheme: "http", Host: destURL.Host}) proxy.Transport = &proxyTransport{ proxyScheme:      req.URL.Scheme, proxyHost:        req.URL.Host, proxyPathPrepend: path.Join(r.prefix, "ns", namespace, resource, id), </del> <ins> go func() { _, err := io.Copy(requestHijackedConn, backendConn) if err != nil && !strings.Contains(err.Error(), "use of closed network connection") { glog.Errorf("Error proxying data from backend to client: %v", err) </ins> } <del> proxy.FlushInterval = 200 * time.Millisecond proxy.ServeHTTP(w, newReq) } </del> <ins> done <- struct{}{} }() <-done return true </ins> } type proxyTransport struct {

Discussion:
The apiserver proxy rewrites links to the form "/proxy/ns/default/...": But this form stopped working recently, seemingly around The "/proxy/ns/default/..." form always returns "404: Page Not Found", similar to the problem seen in If you remove "/ns/default" from the URL, it works.
/cc
I can investigate this as well.
I see the issue, sending a PR.
The proxy path needs to be built with knowledge of the apiversion of the incoming proxy request, and it needs to be updated to use the knowledge from the restmapper. This is a little trickier than I have time for right now, but it should definitely not be hardcode appending the /ns form. Not clear why this is not also caught by our test case. I can try and look at this more in the AM unless someone else wants to take a look in interim. /cc
Let me steal this one from you, I think I can fix it.
Have at it. /cc me on your PR
Sorry, I see you've already got a PR out!
No problem. I would be happy if you finished my PR relative to the commit I started. It will be a few days before I can go back to looking at this issue. I think v1beta1/v1beta2 proxy urls in go-restful need to always but the namespace scope in the path as the ultimate fix. I do want the proxy to have access to the restmapper per my PR. ----- Original Message ----- From: "Daniel Smith" To: "GoogleCloudPlatform/kubernetes" Cc: "Derek Carr" Sent: Friday, February 13, 2015 4:56:19 PM Subject: Re: [kubernetes] apiserver proxy stopped accepting namespaces () Sorry, I see you've already got a PR out! Reply to this email directly or view it on GitHub:
Any updates ?
This is breaking monitoring since it requires the proxy. Bumping up the priority to P0.
Sorry for dropping this. Working on a fix.