Skip to content

Commit f5e0046

Browse files
akhilnittalaakhilnittala
committed
Migration of kube-rbac-proxy in gitops-operator
Signed-off-by: akhil nittala <nakhil@redhat.com>
1 parent 96a7a95 commit f5e0046

5 files changed

Lines changed: 38 additions & 42 deletions

File tree

‎cmd/main.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ import (
7070
"github.com/redhat-developer/gitops-operator/controllers/argocd/openshift"
7171
"github.com/redhat-developer/gitops-operator/controllers/util"
7272
k8sruntime "k8s.io/apimachinery/pkg/runtime"
73+
"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
7374
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
7475
//+kubebuilder:scaffold:imports
7576
)
@@ -148,8 +149,9 @@ func main() {
148149
webhookServer := webhook.NewServer(webhookServerOptions)
149150

150151
metricsServerOptions := metricsserver.Options{
151-
BindAddress: metricsAddr,
152-
TLSOpts: []func(*tls.Config){disableHTTP2},
152+
BindAddress: metricsAddr,
153+
TLSOpts: []func(*tls.Config){disableHTTP2},
154+
FilterProvider: filters.WithAuthenticationAndAuthorization,
153155
}
154156

155157
// Set default manager options

‎config/default/manager_auth_proxy_patch.yaml‎

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -12,36 +12,6 @@ spec:
1212
template:
1313
spec:
1414
containers:
15-
- name: kube-rbac-proxy
16-
image: registry.redhat.io/openshift4/ose-kube-rbac-proxy:v4.15
17-
args:
18-
- --secure-listen-address=0.0.0.0:8443
19-
- --upstream=http://127.0.0.1:8080
20-
- --tls-cert-file=/etc/tls/private/tls.crt
21-
- --tls-private-key-file=/etc/tls/private/tls.key
22-
- --logtostderr=true
23-
- --allow-paths=/metrics
24-
- --http2-disable
25-
ports:
26-
- containerPort: 8443
27-
protocol: TCP
28-
name: metrics
29-
resources:
30-
limits:
31-
cpu: 500m
32-
memory: 128Mi
33-
requests:
34-
cpu: 1m
35-
memory: 15Mi
36-
securityContext:
37-
allowPrivilegeEscalation: false
38-
capabilities:
39-
drop:
40-
- ALL
41-
volumeMounts:
42-
- mountPath: /etc/tls/private
43-
name: kube-rbac-proxy-tls
44-
readOnly: true
4515
- name: manager
4616
args:
4717
- "--health-probe-bind-address=:8081"

‎go.mod‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ require (
3232
)
3333

3434
require (
35+
cel.dev/expr v0.24.0 // indirect
3536
cloud.google.com/go/compute/metadata v0.9.0 // indirect
3637
cyphar.com/go-pathrs v0.2.1 // indirect
3738
dario.cat/mergo v1.0.2 // indirect
@@ -44,6 +45,7 @@ require (
4445
github.com/Masterminds/semver/v3 v3.4.0 // indirect
4546
github.com/Microsoft/go-winio v0.6.2 // indirect
4647
github.com/ProtonMail/go-crypto v1.1.6 // indirect
48+
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
4749
github.com/argoproj/pkg v0.13.7-0.20250305113207-cbc37dc61de5 // indirect
4850
github.com/argoproj/pkg/v2 v2.0.1 // indirect
4951
github.com/beorn7/perks v1.0.1 // indirect
@@ -93,6 +95,7 @@ require (
9395
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
9496
github.com/golang/protobuf v1.5.4 // indirect
9597
github.com/google/btree v1.1.3 // indirect
98+
github.com/google/cel-go v0.26.0 // indirect
9699
github.com/google/gnostic-models v0.7.0 // indirect
97100
github.com/google/go-github/v69 v69.2.0 // indirect
98101
github.com/google/go-github/v75 v75.0.0 // indirect
@@ -102,6 +105,7 @@ require (
102105
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
103106
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 // indirect
104107
github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
108+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
105109
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
106110
github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
107111
github.com/inconshreveable/mousetrap v1.1.0 // indirect
@@ -145,6 +149,7 @@ require (
145149
github.com/skeema/knownhosts v1.3.1 // indirect
146150
github.com/spf13/cobra v1.10.2 // indirect
147151
github.com/spf13/pflag v1.0.10 // indirect
152+
github.com/stoewer/go-strcase v1.3.0 // indirect
148153
github.com/vmihailenco/go-tinylfu v0.2.2 // indirect
149154
github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
150155
github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
@@ -153,13 +158,19 @@ require (
153158
github.com/xlab/treeprint v1.2.0 // indirect
154159
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
155160
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
161+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
156162
go.opentelemetry.io/otel v1.38.0 // indirect
163+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
164+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect
157165
go.opentelemetry.io/otel/metric v1.38.0 // indirect
166+
go.opentelemetry.io/otel/sdk v1.38.0 // indirect
158167
go.opentelemetry.io/otel/trace v1.38.0 // indirect
168+
go.opentelemetry.io/proto/otlp v1.7.1 // indirect
159169
go.uber.org/multierr v1.11.0 // indirect
160170
go.yaml.in/yaml/v2 v2.4.2 // indirect
161171
go.yaml.in/yaml/v3 v3.0.4 // indirect
162172
golang.org/x/crypto v0.47.0 // indirect
173+
golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
163174
golang.org/x/net v0.49.0 // indirect
164175
golang.org/x/oauth2 v0.34.0 // indirect
165176
golang.org/x/sync v0.19.0 // indirect
@@ -189,6 +200,7 @@ require (
189200
k8s.io/kubectl v0.34.0 // indirect
190201
k8s.io/kubernetes v1.34.2 // indirect
191202
oras.land/oras-go/v2 v2.6.0 // indirect
203+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
192204
sigs.k8s.io/gateway-api v1.1.0 // indirect
193205
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
194206
sigs.k8s.io/kustomize/api v0.21.0 // indirect

‎go.sum‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
2+
cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
13
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
24
cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
35
cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
@@ -35,6 +37,8 @@ github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj
3537
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
3638
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
3739
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
40+
github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
41+
github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
3842
github.com/argoproj-labs/argo-rollouts-manager v0.0.8-0.20260224121037-1824164aac67 h1:gFasfvlbOfrwzd7JaVTlnRgE7pDMFC+lQwt07gGGrbY=
3943
github.com/argoproj-labs/argo-rollouts-manager v0.0.8-0.20260224121037-1824164aac67/go.mod h1:WPyZkNHZjir/OTt8mrRwcUZKe1euHrHPJsRv1Wp/F/0=
4044
github.com/argoproj-labs/argocd-image-updater v1.1.1 h1:7YDaR3WX2NMsDKp0wN7TRaRRHaVHQ94tSybi2P99MGk=
@@ -205,6 +209,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
205209
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
206210
github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
207211
github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
212+
github.com/google/cel-go v0.26.0 h1:DPGjXackMpJWH680oGY4lZhYjIameYmR+/6RBdDGmaI=
213+
github.com/google/cel-go v0.26.0/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM=
208214
github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
209215
github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
210216
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -239,6 +245,8 @@ github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 h1:B+8ClL/kCQkRiU82d9xajR
239245
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3/go.mod h1:NbCUVmiS4foBGBHOYlCT25+YmGpJ32dZPi75pGEUpj4=
240246
github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
241247
github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
248+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
249+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
242250
github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
243251
github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
244252
github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
@@ -406,6 +414,8 @@ github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiT
406414
github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
407415
github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
408416
github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
417+
github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
418+
github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
409419
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
410420
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
411421
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -453,8 +463,14 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
453463
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
454464
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 h1:YH4g8lQroajqUwWbq/tr2QX1JFmEXaDLgG+ew9bLMWo=
455465
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ=
466+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 h1:CV7UdSGJt/Ao6Gp4CXckLxVRRsRgDHoI8XjbL3PDl8s=
467+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0/go.mod h1:FRmFuRJfag1IZ2dPkHnEoSFVgTVPUd2qf5Vi69hLb8I=
456468
go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
457469
go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
470+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24=
471+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU=
472+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 h1:lwI4Dc5leUqENgGuQImwLo4WnuXFPetmPpkLi2IrX54=
473+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0/go.mod h1:Kz/oCE7z5wuyhPxsXDuaPteSWqjSBD5YaSdbxZYGbGk=
458474
go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
459475
go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
460476
go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
@@ -463,6 +479,8 @@ go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6
463479
go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
464480
go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
465481
go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
482+
go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
483+
go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
466484
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
467485
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
468486
go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
@@ -484,6 +502,8 @@ golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw
484502
golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
485503
golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
486504
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
505+
golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f h1:XdNn9LlyWAhLVp6P/i8QYBW+hlyhrhei9uErw2B5GJo=
506+
golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f/go.mod h1:D5SMRVC3C2/4+F/DB1wZsLRnSNimn2Sp/NPsCrsv8ak=
487507
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
488508
golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
489509
golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -686,6 +706,8 @@ k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8
686706
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
687707
oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
688708
oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
709+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=
710+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
689711
sigs.k8s.io/controller-runtime v0.22.3 h1:I7mfqz/a/WdmDCEnXmSPm8/b/yRTy6JsKKENTijTq8Y=
690712
sigs.k8s.io/controller-runtime v0.22.3/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
691713
sigs.k8s.io/gateway-api v1.1.0 h1:DsLDXCi6jR+Xz8/xd0Z1PYl2Pn0TyaFMOPPZIj4inDM=

‎hack/non-olm-install/install-gitops-operator.sh‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -253,16 +253,6 @@ spec:
253253
openshift.io/scc: restricted-v2
254254
spec:
255255
containers:
256-
- name: kube-rbac-proxy
257-
securityContext:
258-
allowPrivilegeEscalation: false
259-
capabilities:
260-
drop:
261-
- ALL
262-
readOnlyRootFilesystem: true
263-
runAsNonRoot: true
264-
seccompProfile:
265-
type: RuntimeDefault
266256
- name: manager
267257
securityContext:
268258
allowPrivilegeEscalation: false

0 commit comments

Comments
 (0)