Skip to content

Commit e4a718f

Browse files
bastjanbastjan
authored
Merge pull request #86 from appuio/native-metrics-auth
Remove `kube-rbac-proxy` in favour of native metrics authentication
2 parents 480467f + a63d64e commit e4a718f

File tree

20 files changed

+241
-168
lines changed

20 files changed

+241
-168
lines changed

‎class/defaults.yml‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,7 @@ parameters:
1313
openshift_upgrade_controller:
1414
registry: ghcr.io
1515
image: appuio/openshift-upgrade-controller
16-
tag: v0.13.0
17-
kube_rbac_proxy:
18-
registry: quay.io
19-
image: brancz/kube-rbac-proxy
20-
tag: v0.18.2
16+
tag: v0.14.0
2117
oc:
2218
registry: quay.io
2319
image: appuio/oc

‎component/openshift-upgrade-controller.jsonnet‎

Lines changed: 90 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -42,13 +42,98 @@ com.Kustomization(
4242
newTag: image.tag,
4343
newName: '%(registry)s/%(image)s' % image,
4444
},
45-
'quay.io/brancz/kube-rbac-proxy': {
46-
local image = params.images.kube_rbac_proxy,
47-
newTag: image.tag,
48-
newName: '%(registry)s/%(image)s' % image,
49-
},
5045
},
5146
params.kustomize_input {
47+
// Inner kustomization layers are immutable, so we need to re-replace the namespace after changing it in an outer layer
48+
replacements: [
49+
{
50+
source: {
51+
kind: 'Service',
52+
version: 'v1',
53+
name: 'controller-manager-metrics-service',
54+
fieldPath: 'metadata.name',
55+
},
56+
targets: [
57+
{
58+
select: {
59+
kind: 'Certificate',
60+
group: 'cert-manager.io',
61+
version: 'v1',
62+
name: 'metrics-certs',
63+
},
64+
fieldPaths: [
65+
'spec.dnsNames.0',
66+
'spec.dnsNames.1',
67+
],
68+
options: {
69+
delimiter: '.',
70+
index: 0,
71+
create: true,
72+
},
73+
},
74+
{
75+
select: {
76+
kind: 'ServiceMonitor',
77+
group: 'monitoring.coreos.com',
78+
version: 'v1',
79+
name: 'controller-manager-metrics-monitor',
80+
},
81+
fieldPaths: [
82+
'spec.endpoints.0.tlsConfig.serverName',
83+
],
84+
options: {
85+
delimiter: '.',
86+
index: 0,
87+
create: true,
88+
},
89+
},
90+
],
91+
},
92+
{
93+
source: {
94+
kind: 'Service',
95+
version: 'v1',
96+
name: 'controller-manager-metrics-service',
97+
fieldPath: 'metadata.namespace',
98+
},
99+
targets: [
100+
{
101+
select: {
102+
kind: 'Certificate',
103+
group: 'cert-manager.io',
104+
version: 'v1',
105+
name: 'metrics-certs',
106+
},
107+
fieldPaths: [
108+
'spec.dnsNames.0',
109+
'spec.dnsNames.1',
110+
],
111+
options: {
112+
delimiter: '.',
113+
index: 1,
114+
create: true,
115+
},
116+
},
117+
{
118+
select: {
119+
kind: 'ServiceMonitor',
120+
group: 'monitoring.coreos.com',
121+
version: 'v1',
122+
name: 'controller-manager-metrics-monitor',
123+
},
124+
fieldPaths: [
125+
'spec.endpoints.0.tlsConfig.serverName',
126+
],
127+
options: {
128+
delimiter: '.',
129+
index: 1,
130+
create: true,
131+
},
132+
},
133+
],
134+
},
135+
],
136+
52137
patches+: [
53138
patch(removeUpstreamNamespace),
54139
setPriorityClass,

‎tests/golden/defaults/openshift-upgrade-controller/openshift-upgrade-controller/apps_v1_deployment_openshift-upgrade-controller-controller-manager.yaml‎

Lines changed: 19 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -23,56 +23,17 @@ spec:
2323
labels:
2424
control-plane: controller-manager
2525
spec:
26-
affinity:
27-
nodeAffinity:
28-
requiredDuringSchedulingIgnoredDuringExecution:
29-
nodeSelectorTerms:
30-
- matchExpressions:
31-
- key: kubernetes.io/arch
32-
operator: In
33-
values:
34-
- amd64
35-
- arm64
36-
- ppc64le
37-
- s390x
38-
- key: kubernetes.io/os
39-
operator: In
40-
values:
41-
- linux
4226
containers:
4327
- args:
44-
- --secure-listen-address=0.0.0.0:8443
45-
- --upstream=http://127.0.0.1:8080/
46-
- --logtostderr=true
47-
- --v=0
48-
image: quay.io/brancz/kube-rbac-proxy:v0.18.2
49-
name: kube-rbac-proxy
50-
ports:
51-
- containerPort: 8443
52-
name: https
53-
protocol: TCP
54-
resources:
55-
limits:
56-
cpu: 500m
57-
memory: 128Mi
58-
requests:
59-
cpu: 5m
60-
memory: 64Mi
61-
securityContext:
62-
allowPrivilegeEscalation: false
63-
capabilities:
64-
drop:
65-
- ALL
66-
- args:
67-
- --health-probe-bind-address=:8081
68-
- --metrics-bind-address=127.0.0.1:8080
28+
- --metrics-bind-address=:8443
6929
- --leader-elect
30+
- --metrics-cert-path=/tmp/k8s-metrics-server/metrics-certs
7031
env:
7132
- name: POD_NAMESPACE
7233
valueFrom:
7334
fieldRef:
7435
fieldPath: metadata.namespace
75-
image: ghcr.io/appuio/openshift-upgrade-controller:v0.13.0
36+
image: ghcr.io/appuio/openshift-upgrade-controller:v0.14.0
7637
livenessProbe:
7738
httpGet:
7839
path: /healthz
@@ -98,10 +59,26 @@ spec:
9859
capabilities:
9960
drop:
10061
- ALL
62+
volumeMounts:
63+
- mountPath: /tmp/k8s-metrics-server/metrics-certs
64+
name: metrics-certs
65+
readOnly: true
10166
priorityClassName: system-cluster-critical
10267
securityContext:
10368
runAsNonRoot: true
10469
seccompProfile:
10570
type: RuntimeDefault
10671
serviceAccountName: openshift-upgrade-controller-controller-manager
10772
terminationGracePeriodSeconds: 10
73+
volumes:
74+
- name: metrics-certs
75+
secret:
76+
items:
77+
- key: ca.crt
78+
path: ca.crt
79+
- key: tls.crt
80+
path: tls.crt
81+
- key: tls.key
82+
path: tls.key
83+
optional: false
84+
secretName: metrics-server-cert

‎tests/golden/defaults/openshift-upgrade-controller/openshift-upgrade-controller/cert-manager.io_v1_certificate_openshift-upgrade-controller-metrics-certs.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
labels:
5+
app.kubernetes.io/managed-by: commodore
6+
app.kubernetes.io/name: openshift-upgrade-controller
7+
name: openshift-upgrade-controller-metrics-certs
8+
namespace: appuio-openshift-upgrade-controller
9+
spec:
10+
dnsNames:
11+
- openshift-upgrade-controller-controller-manager-metrics-service.appuio-openshift-upgrade-controller.svc
12+
- openshift-upgrade-controller-controller-manager-metrics-service.appuio-openshift-upgrade-controller.svc.cluster.local
13+
issuerRef:
14+
kind: Issuer
15+
name: openshift-upgrade-controller-selfsigned-issuer
16+
secretName: metrics-server-cert

‎tests/golden/defaults/openshift-upgrade-controller/openshift-upgrade-controller/cert-manager.io_v1_issuer_openshift-upgrade-controller-selfsigned-issuer.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Issuer
3+
metadata:
4+
labels:
5+
app.kubernetes.io/managed-by: commodore
6+
app.kubernetes.io/name: openshift-upgrade-controller
7+
name: openshift-upgrade-controller-selfsigned-issuer
8+
namespace: appuio-openshift-upgrade-controller
9+
spec:
10+
selfSigned: {}

‎tests/golden/defaults/openshift-upgrade-controller/openshift-upgrade-controller/monitoring.coreos.com_v1_servicemonitor_openshift-upgrade-controller-controller-manager-metrics-monitor.yaml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,19 @@ spec:
2323
port: https
2424
scheme: https
2525
tlsConfig:
26-
insecureSkipVerify: true
26+
ca:
27+
secret:
28+
key: ca.crt
29+
name: metrics-server-cert
30+
cert:
31+
secret:
32+
key: tls.crt
33+
name: metrics-server-cert
34+
insecureSkipVerify: false
35+
keySecret:
36+
key: tls.key
37+
name: metrics-server-cert
38+
serverName: openshift-upgrade-controller-controller-manager-metrics-service.appuio-openshift-upgrade-controller.svc
2739
selector:
2840
matchLabels:
2941
control-plane: controller-manager

tests/golden/defaults/openshift-upgrade-controller/openshift-upgrade-controller/rbac.authorization.k8s.io_v1_clusterrole_openshift-upgrade-controller-proxy-role.yaml renamed to tests/golden/defaults/openshift-upgrade-controller/openshift-upgrade-controller/rbac.authorization.k8s.io_v1_clusterrole_openshift-upgrade-controller-metrics-auth-role.yaml

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,8 @@ apiVersion: rbac.authorization.k8s.io/v1
22
kind: ClusterRole
33
metadata:
44
labels:
5-
app.kubernetes.io/component: kube-rbac-proxy
6-
app.kubernetes.io/created-by: openshift-upgrade-controller
7-
app.kubernetes.io/instance: proxy-role
85
app.kubernetes.io/managed-by: commodore
9-
app.kubernetes.io/name: clusterrole
10-
app.kubernetes.io/part-of: openshift-upgrade-controller
11-
name: openshift-upgrade-controller-proxy-role
6+
name: openshift-upgrade-controller-metrics-auth-role
127
rules:
138
- apiGroups:
149
- authentication.k8s.io

‎tests/golden/defaults/openshift-upgrade-controller/openshift-upgrade-controller/rbac.authorization.k8s.io_v1_clusterrole_openshift-upgrade-controller-metrics-reader.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
22
kind: ClusterRole
33
metadata:
44
labels:
5-
app.kubernetes.io/component: kube-rbac-proxy
6-
app.kubernetes.io/created-by: openshift-upgrade-controller
7-
app.kubernetes.io/instance: metrics-reader
85
app.kubernetes.io/managed-by: commodore
9-
app.kubernetes.io/name: clusterrole
10-
app.kubernetes.io/part-of: openshift-upgrade-controller
116
name: openshift-upgrade-controller-metrics-reader
127
rules:
138
- nonResourceURLs:

‎tests/golden/defaults/openshift-upgrade-controller/openshift-upgrade-controller/rbac.authorization.k8s.io_v1_clusterrolebinding_openshift-upgrade-controller-metrics-auth-rolebinding.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
labels:
5+
app.kubernetes.io/managed-by: commodore
6+
name: openshift-upgrade-controller-metrics-auth-rolebinding
7+
roleRef:
8+
apiGroup: rbac.authorization.k8s.io
9+
kind: ClusterRole
10+
name: openshift-upgrade-controller-metrics-auth-role
11+
subjects:
12+
- kind: ServiceAccount
13+
name: openshift-upgrade-controller-controller-manager
14+
namespace: appuio-openshift-upgrade-controller

‎tests/golden/defaults/openshift-upgrade-controller/openshift-upgrade-controller/rbac.authorization.k8s.io_v1_clusterrolebinding_openshift-upgrade-controller-proxy-rolebinding.yaml‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

0 commit comments

Comments
 (0)