Change:
Now that we've moved the experimental api to /apis/experimental... it's inaccessible from by default. We should fix that. who stepped on this earlier
security questions for you: this prefix was apparently in response to a security review quite some time ago. I don't understand how this adds much security. Can we just remove it? If not, is it acceptable to change the default from "/api/" to "/api", which would match both api locations? Otherwise we'll have to take a comma-separated list or something...
Ref
Oh, so this is not related to the security requests! And the original use case was just to re-root the URL path so it didn't interfere with static content. Sorry, I got confused because the last time I monkeyed with that, it was in conjunction with the allow/deny list that actually was the security request. In that case, let's see if we can change the default to "/", if that will break anything.
That change got introduced as part of to protect against XSRF in kubectl proxy. But I think the more important part of that change was that it disallows POST/PUT/PATCH by default. So as long as there is no state changing action outside of /api/ that can be triggered with a GET it should be safe to remove.

Discussion:
The IP address on which to serve on. .PP <del> fB--api-prefixfP="/api/" </del> <ins> fB--api-prefixfP="/" </ins> Prefix to serve the proxied API under. .PP

--accept-hosts="^localhost$,^127.0.0.1$,^[::1]$": Regular expression for hosts that the proxy should accept. --accept-paths="^/.*": Regular expression for paths that the proxy should accept. --address="127.0.0.1": The IP address on which to serve on. <del> --api-prefix="/api/": Prefix to serve the proxied API under. </del> <ins> --api-prefix="/": Prefix to serve the proxied API under. </ins> --disable-filter[=false]: If true, disable request filtering in the proxy. This is dangerous, and can leave you vulnerable to XSRF attacks, when used with an accessible port. -p, --port=8001: The port on which to run the proxy. Set to 0 to pick a random port. --reject-methods="POST,PUT,PATCH": Regular expression for HTTP methods that the proxy should reject.

PROXY_PORT= } <del> # Starts "kubect proxy" to test the client proxy. You may pass options, e.g. # --api-prefix. </del> <ins> # Starts "kubect proxy" to test the client proxy. $1: api_prefix </ins> function start-proxy() { stop-proxy

PROXY_PORT=$(kube::util::get_random_port) kube::log::status "On try ${retry}, use proxy port ${PROXY_PORT} if it's free" if kube::util::test_host_port_free "127.0.0.1" "${PROXY_PORT}"; then <del> # the --www and --www-prefix are just to make something definitely show up for # wait_for_url to see. kubectl proxy -p ${PROXY_PORT} --www=. --www-prefix=/healthz "$@" 1>&2 & break </del> <ins> if [ $# -eq 0 ]; then kubectl proxy -p ${PROXY_PORT} --www=. 1>&2 & break else kubectl proxy -p ${PROXY_PORT} --www=. --api-prefix="$1" 1>&2 & break fi </ins> fi sleep 1; done PROXY_PID=$! <del> kube::util::wait_for_url "http://127.0.0.1:${PROXY_PORT}/healthz" "kubectl proxy $@" </del> <ins> if [ $# -eq 0 ]; then kube::util::wait_for_url "http://127.0.0.1:${PROXY_PORT}/healthz" "kubectl proxy" else kube::util::wait_for_url "http://127.0.0.1:${PROXY_PORT}/$1/healthz" "kubectl proxy --api-prefix=$1" fi </ins> } function cleanup()

--kubelet-port=${KUBELET_PORT}  --runtime-config=api/v1  --cert-dir="${TMPDIR:-/tmp/}"  <ins> --runtime_config="extensions/v1beta1=true"  </ins> --service-cluster-ip-range="10.0.0.0/24" 1>&2 & APISERVER_PID=$!

####################### # Make sure the UI can be proxied <del> start-proxy --api-prefix=/ </del> <ins> start-proxy </ins> check-curl-proxy-code /ui 301 check-curl-proxy-code /metrics 200 <ins> check-curl-proxy-code /api/ui 404 </ins> if [[ -n "${version}" ]]; then check-curl-proxy-code /api/${version}/namespaces 200 fi <ins> check-curl-proxy-code /static/ 200 </ins> stop-proxy <del> # Default proxy locks you into the /api path (legacy behavior) </del> <ins> # Make sure the in-development api is accessible by default </ins> start-proxy <del> check-curl-proxy-code /ui 404 check-curl-proxy-code /metrics 404 check-curl-proxy-code /api/ui 404 if [[ -n "${version}" ]]; then check-curl-proxy-code /api/${version}/namespaces 200 fi </del> <ins> check-curl-proxy-code /apis 200 check-curl-proxy-code /apis/extensions/ 200 </ins> stop-proxy # Custom paths let you see everything. <del> start-proxy --api-prefix=/custom </del> <ins> start-proxy /custom </ins> check-curl-proxy-code /custom/ui 301 check-curl-proxy-code /custom/metrics 200 if [[ -n "${version}" ]]; then

} cmd.Flags().StringP("www", "w", "", "Also serve static files from the given directory under the specified prefix.") cmd.Flags().StringP("www-prefix", "P", "/static/", "Prefix to serve static files under, if static file directory is specified.") <del> cmd.Flags().StringP("api-prefix", "", "/api/", "Prefix to serve the proxied API under.") </del> <ins> cmd.Flags().StringP("api-prefix", "", "/", "Prefix to serve the proxied API under.") </ins> cmd.Flags().String("accept-paths", kubectl.DefaultPathAcceptRE, "Regular expression for paths that the proxy should accept.") cmd.Flags().String("reject-paths", kubectl.DefaultPathRejectRE, "Regular expression for paths that the proxy should reject.") cmd.Flags().String("accept-hosts", kubectl.DefaultHostAcceptRE, "Regular expression for hosts that the proxy should accept.")