Skip to content

Commit 830b1dd

Browse files
akhilnittalaakhilnittala
authored
Migration of kube-rbac-proxy in gitops-operator (#1119)
* Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> * Migration of kube-rbac-proxy in gitops-operator Signed-off-by: akhil nittala <[email protected]> --------- Signed-off-by: akhil nittala <[email protected]>
1 parent 3449b6a commit 830b1dd

15 files changed

Lines changed: 106 additions & 142 deletions

‎bundle/manifests/gitops-operator.clusterserviceversion.yaml‎

Lines changed: 8 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ metadata:
190190
capabilities: Deep Insights
191191
console.openshift.io/plugins: '["gitops-plugin"]'
192192
containerImage: quay.io/redhat-developer/gitops-operator
193-
createdAt: "2026-04-09T19:32:55Z"
193+
createdAt: "2026-04-21T13:41:53Z"
194194
description: Enables teams to adopt GitOps principles for managing cluster configurations
195195
and application delivery across hybrid multi-cluster Kubernetes environments.
196196
features.operators.openshift.io/disconnected: "true"
@@ -859,7 +859,7 @@ spec:
859859
containers:
860860
- args:
861861
- --health-probe-bind-address=:8081
862-
- --metrics-bind-address=127.0.0.1:8080
862+
- --metrics-bind-address=:8443
863863
- --leader-elect
864864
command:
865865
- /usr/local/bin/manager
@@ -885,6 +885,12 @@ spec:
885885
- containerPort: 9443
886886
name: webhook-server
887887
protocol: TCP
888+
- containerPort: 8443
889+
name: metrics
890+
protocol: TCP
891+
- containerPort: 8081
892+
name: health
893+
protocol: TCP
888894
readinessProbe:
889895
httpGet:
890896
path: /readyz
@@ -899,44 +905,10 @@ spec:
899905
- ALL
900906
readOnlyRootFilesystem: true
901907
runAsNonRoot: true
902-
- args:
903-
- --secure-listen-address=0.0.0.0:8443
904-
- --upstream=http://127.0.0.1:8080
905-
- --tls-cert-file=/etc/tls/private/tls.crt
906-
- --tls-private-key-file=/etc/tls/private/tls.key
907-
- --logtostderr=true
908-
- --allow-paths=/metrics
909-
- --http2-disable
910-
image: registry.redhat.io/openshift4/ose-kube-rbac-proxy:v4.15
911-
name: kube-rbac-proxy
912-
ports:
913-
- containerPort: 8443
914-
name: metrics
915-
protocol: TCP
916-
resources:
917-
limits:
918-
cpu: 500m
919-
memory: 128Mi
920-
requests:
921-
cpu: 1m
922-
memory: 15Mi
923-
securityContext:
924-
allowPrivilegeEscalation: false
925-
capabilities:
926-
drop:
927-
- ALL
928-
volumeMounts:
929-
- mountPath: /etc/tls/private
930-
name: kube-rbac-proxy-tls
931-
readOnly: true
932908
securityContext:
933909
runAsNonRoot: true
934910
serviceAccountName: openshift-gitops-operator-controller-manager
935911
terminationGracePeriodSeconds: 10
936-
volumes:
937-
- name: kube-rbac-proxy-tls
938-
secret:
939-
secretName: kube-rbac-proxy-tls
940912
permissions:
941913
- rules:
942914
- apiGroups:

‎cmd/main.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ import (
7070
"github.com/redhat-developer/gitops-operator/controllers/argocd/openshift"
7171
"github.com/redhat-developer/gitops-operator/controllers/util"
7272
k8sruntime "k8s.io/apimachinery/pkg/runtime"
73+
"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
7374
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
7475
//+kubebuilder:scaffold:imports
7576
)
@@ -148,8 +149,9 @@ func main() {
148149
webhookServer := webhook.NewServer(webhookServerOptions)
149150

150151
metricsServerOptions := metricsserver.Options{
151-
BindAddress: metricsAddr,
152-
TLSOpts: []func(*tls.Config){disableHTTP2},
152+
BindAddress: metricsAddr,
153+
TLSOpts: []func(*tls.Config){disableHTTP2},
154+
FilterProvider: filters.WithAuthenticationAndAuthorization,
153155
}
154156

155157
// Set default manager options

‎config/default/kustomization.yaml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,12 @@ bases:
2424
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
2525
- ../prometheus
2626

27+
# Protect the /metrics endpoint with controller-runtime authn/authz.
28+
# If you comment out manager_metrics_patch.yaml, also comment out metrics_service.yaml,
29+
# metrics_role.yaml, metrics_role_binding.yaml, and metrics_reader_clusterrole.yaml
30+
# in ../rbac/kustomization.yaml so the metrics Service is disabled as well.
2731
patchesStrategicMerge:
28-
# Protect the /metrics endpoint by putting it behind auth.
29-
# If you want your controller-manager to expose the /metrics
30-
# endpoint w/o any authn/z, please comment the following line.
31-
- manager_auth_proxy_patch.yaml
32+
- manager_metrics_patch.yaml
3233

3334
# Mount the controller config file for loading manager configurations
3435
# through a ComponentConfig type

‎config/default/manager_auth_proxy_patch.yaml‎

Lines changed: 0 additions & 57 deletions
This file was deleted.

‎config/default/manager_metrics_patch.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: controller-manager
5+
namespace: system
6+
spec:
7+
selector:
8+
matchLabels:
9+
control-plane: gitops-operator
10+
template:
11+
spec:
12+
containers:
13+
- name: manager
14+
args:
15+
- "--health-probe-bind-address=:8081"
16+
- "--metrics-bind-address=:8443"
17+
- "--leader-elect"
18+
ports:
19+
- name: metrics
20+
containerPort: 8443
21+
protocol: TCP
22+
- name: health
23+
containerPort: 8081
24+
protocol: TCP

‎config/rbac/kustomization.yaml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,11 @@ resources:
99
- role_binding.yaml
1010
- leader_election_role.yaml
1111
- leader_election_role_binding.yaml
12-
# Comment the following 4 lines if you want to disable
13-
# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
14-
# which protects your /metrics endpoint.
15-
- auth_proxy_service.yaml
16-
- auth_proxy_role.yaml
17-
- auth_proxy_role_binding.yaml
18-
# - auth_proxy_client_clusterrole.yaml
12+
# These resources expose /metrics over HTTPS on port 8443 and grant the
13+
# controller-runtime authn/authz permissions required by manager_metrics_patch.yaml.
14+
# Comment these lines together with manager_metrics_patch.yaml if you want to
15+
# disable secure metrics for the controller-manager.
16+
- metrics_service.yaml
17+
- metrics_role.yaml
18+
- metrics_role_binding.yaml
19+
# - metrics_reader_clusterrole.yaml

config/rbac/auth_proxy_client_clusterrole.yaml renamed to config/rbac/metrics_reader_clusterrole.yaml

File renamed without changes.

config/rbac/auth_proxy_role.yaml renamed to config/rbac/metrics_role.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: rbac.authorization.k8s.io/v1
22
kind: ClusterRole
33
metadata:
4-
name: proxy-role
4+
name: metrics-role
55
rules:
66
- nonResourceURLs:
77
- "/metrics"

config/rbac/auth_proxy_role_binding.yaml renamed to config/rbac/metrics_role_binding.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
apiVersion: rbac.authorization.k8s.io/v1
22
kind: ClusterRoleBinding
33
metadata:
4-
name: proxy-rolebinding
4+
name: metrics-rolebinding
55
roleRef:
66
apiGroup: rbac.authorization.k8s.io
77
kind: ClusterRole
8-
name: proxy-role
8+
name: metrics-role
99
subjects:
1010
- kind: ServiceAccount
1111
name: controller-manager

config/rbac/auth_proxy_service.yaml renamed to config/rbac/metrics_service.yaml

File renamed without changes.

0 commit comments

Comments
 (0)