Disable HTTP/2 by Default to Mitigate CVE Risks

[anshuman-agarwala]

There is a security vulnerability in golang/net which can allow malicious authorized clients to DOS the kube-apiserver.
More information can be found in kubernetes/kubernetes#121197

The workaround for this issue that other projects have adopted is to make http/2 optional using a flag.
More information about the cve:
GHSA-qppj-fm5r-hxr3
GHSA-4374-p667-p6c8

[troy0820]

It looks like we are already using the patched version of where this is impacted

• golang.org/x/net v0.30.0 > v0.17.0

• google.golang.org/grpc v1.65.0 https://github.com/grpc/grpc-go/releases/tag/v1.65.0

as indirect dependencies, unless I am missing something?

[sbueringer]

Agree, thx @troy0820 for looking into it!

/close

[k8s-ci-robot]

@sbueringer: Closing this issue.

In response to this:

Agree, thx @troy0820 for looking into it!

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.