Add config param to disable the /admin/shutdown endpoint

Issue Type:

• Bug report
• Feature request

What happened:

Currently it is possible to shutdown any Linkerd instance by simple posting to the /admin/shutdown endpoint. While I can imagine that many scenarios appreciate this behavior, it might not always be the case and could lead to a decrease in availability if attackers repeatedly post to this endpoint.

What you expected to happen:

It would be nice to have a configuration parameter that allows to disable this endpoint.

How to reproduce it (as minimally and precisely as possible):

Start Linkerd locally and run the following command:

$ curl -v -X POST localhost:9990/admin/shutdown

Linkerd will shut down asap.

Anything else we need to know?:

Environment:

• linkerd/namerd version, config files: Latest version, any config that enables the admin server
• Platform, version, and config files (Kubernetes, DC/OS, etc): OS X
• Cloud provider or hardware configuration:

[adleong]

Also a big thanks to @robertpanzer for taking the lead on this long outstanding issue! 🙏

[robertpanzer]

That sounds great. I would just like to also have a whitelist in addition. When we add own pages to the admin ui we should be able to whitelist them explicitly without having to open everything.