chore(api): harden HTTP server initialization based on Gosec (G112, G114)

modules/api/main.go

@@ -93,20 +93,40 @@ func main() {
 
 func serve() {
 	klog.V(1).InfoS("Listening and serving on", "address", args.InsecureAddress())
-	go func() { klog.Fatal(http.ListenAndServe(args.InsecureAddress(), nil)) }()
+
+	server := &http.Server{
+		Addr:         args.InsecureAddress(),
+		Handler:      http.DefaultServeMux,
+		ReadTimeout:  10 * time.Second,
+		WriteTimeout: 10 * time.Second,
+		IdleTimeout:  60 * time.Second,
+	}
+
+	go func() {
+		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			klog.Fatal(err)
+		}
+	}()
 }
 
 func serveTLS(certificates []tls.Certificate) {
 	klog.V(1).InfoS("Listening and serving on", "address", args.Address())
 	server := &http.Server{
-		Addr:    args.Address(),
-		Handler: http.DefaultServeMux,
+		Addr:         args.Address(),
+		Handler:      http.DefaultServeMux,
+		ReadTimeout:  10 * time.Second,
+		WriteTimeout: 10 * time.Second,
+		IdleTimeout:  60 * time.Second,
 		TLSConfig: &tls.Config{
 			Certificates: certificates,
 			MinVersion:   tls.VersionTLS12,
 		},
 	}
-	go func() { klog.Fatal(server.ListenAndServeTLS("", "")) }()
+	go func() {
+		if err := server.ListenAndServeTLS("", ""); err != nil && err != http.ErrServerClosed {
+			klog.Fatal(err)
+		}
+	}()
 }
 
 func ensureAPIServerConnectionOrDie() {

modules/api/pkg/args/pprof.go

@@ -19,6 +19,8 @@ import (
 	"net/http"
 	"net/http/pprof"
 
+	"time"
+
 	"k8s.io/klog/v2"
 )
 
@@ -28,7 +30,14 @@ func initProfiler() {
 	mux := http.NewServeMux()
 	mux.HandleFunc(defaultProfilerPath, pprof.Index)
 	go func() {
-		if err := http.ListenAndServe(fmt.Sprintf(":%d", defaultProfilerPort), mux); err != nil {
+		server := &http.Server{
+			Addr:         fmt.Sprintf(":%d", defaultPrometheusPort),
+			Handler:      mux,
+			ReadTimeout:  10 * time.Second,
+			WriteTimeout: 10 * time.Second,
+			IdleTimeout:  60 * time.Second,
+		}
+		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
 			klog.Fatal(err)
 		}
 	}()

modules/api/pkg/args/prometheus.go

@@ -18,6 +18,8 @@ import (
 	"fmt"
 	"net/http"
 
+	"time"
+
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"k8s.io/klog/v2"
 )
@@ -28,7 +30,14 @@ func initPrometheus() {
 	mux := http.NewServeMux()
 	mux.Handle(defaultPrometheusPath, promhttp.Handler())
 	go func() {
-		if err := http.ListenAndServe(fmt.Sprintf(":%d", defaultPrometheusPort), mux); err != nil {
+		server := &http.Server{
+			Addr:         fmt.Sprintf(":%d", defaultPrometheusPort),
+			Handler:      mux,
+			ReadTimeout:  10 * time.Second,
+			WriteTimeout: 10 * time.Second,
+			IdleTimeout:  60 * time.Second,
+		}
+		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
 			klog.Fatal(err)
 		}
 	}()

modules/metrics-scraper/main.go

@@ -75,7 +75,17 @@ func main() {
 
 		api.Manager(r, db)
 		// Bind to a port and pass our router in
-		klog.Fatal(http.ListenAndServe(":8000", handlers.CombinedLoggingHandler(os.Stdout, r)))
+
+		server := &http.Server{
+			Addr:         ":8000",
+			Handler:      handlers.CombinedLoggingHandler(os.Stdout, r),
+			ReadTimeout:  10 * time.Second,
+			WriteTimeout: 10 * time.Second,
+			IdleTimeout:  60 * time.Second,
+		}
+		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			klog.Fatal(err)
+		}
 	}()
 
 	// Start the machine. Scrape every metricResolution