Skip to content

Commit 31f4fe2

Browse files
int128github-actions[bot]
int128
and
github-actions[bot]
authored
Upgrade from kubebuilder v4.0.0 to v4.1.1 (#1128)
* Upgrade from kubebuilder v4.0.0 to v4.1.0 * Upgrade from kubebuilder v4.1.0 to v4.1.1 * Fix kustomization.yaml --------- Co-authored-by: update-generated-files-action <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 47e624f commit 31f4fe2

File tree

12 files changed

+175
-40
lines changed

12 files changed

+175
-40
lines changed

‎Makefile‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -152,16 +152,16 @@ $(LOCALBIN):
152152

153153
## Tool Binaries
154154
KUBECTL ?= kubectl
155-
KUSTOMIZE ?= $(LOCALBIN)/kustomize-$(KUSTOMIZE_VERSION)
156-
CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen-$(CONTROLLER_TOOLS_VERSION)
157-
ENVTEST ?= $(LOCALBIN)/setup-envtest-$(ENVTEST_VERSION)
158-
GOLANGCI_LINT = $(LOCALBIN)/golangci-lint-$(GOLANGCI_LINT_VERSION)
155+
KUSTOMIZE ?= $(LOCALBIN)/kustomize
156+
CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
157+
ENVTEST ?= $(LOCALBIN)/setup-envtest
158+
GOLANGCI_LINT = $(LOCALBIN)/golangci-lint
159159

160160
## Tool Versions
161-
KUSTOMIZE_VERSION ?= v5.4.1
161+
KUSTOMIZE_VERSION ?= v5.4.2
162162
CONTROLLER_TOOLS_VERSION ?= v0.15.0
163163
ENVTEST_VERSION ?= release-0.18
164-
GOLANGCI_LINT_VERSION ?= v1.57.2
164+
GOLANGCI_LINT_VERSION ?= v1.59.1
165165

166166
.PHONY: kustomize
167167
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
@@ -181,18 +181,20 @@ $(ENVTEST): $(LOCALBIN)
181181
.PHONY: golangci-lint
182182
golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary.
183183
$(GOLANGCI_LINT): $(LOCALBIN)
184-
$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,${GOLANGCI_LINT_VERSION})
184+
$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))
185185

186186
# go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist
187-
# $1 - target path with name of binary (ideally with version)
187+
# $1 - target path with name of binary
188188
# $2 - package url which can be installed
189189
# $3 - specific version of package
190190
define go-install-tool
191-
@[ -f $(1) ] || { \
191+
@[ -f "$(1)-$(3)" ] || { \
192192
set -e; \
193193
package=$(2)@$(3) ;\
194194
echo "Downloading $${package}" ;\
195+
rm -f $(1) || true ;\
195196
GOBIN=$(LOCALBIN) go install $${package} ;\
196-
mv "$$(echo "$(1)" | sed "s/-$(3)$$//")" $(1) ;\
197-
}
197+
mv $(1) $(1)-$(3) ;\
198+
} ;\
199+
ln -sf $(1)-$(3) $(1)
198200
endef

‎cmd/main.go‎

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ import (
3333
ctrl "sigs.k8s.io/controller-runtime"
3434
"sigs.k8s.io/controller-runtime/pkg/healthz"
3535
"sigs.k8s.io/controller-runtime/pkg/log/zap"
36+
"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
3637
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
3738
"sigs.k8s.io/controller-runtime/pkg/webhook"
3839

@@ -65,14 +66,15 @@ func main() {
6566
var probeAddr string
6667
var secureMetrics bool
6768
var enableHTTP2 bool
68-
flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metric endpoint binds to. "+
69-
"Use the port :8080. If not set, it will be 0 in order to disable the metrics server")
69+
var tlsOpts []func(*tls.Config)
70+
flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
71+
"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
7072
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
7173
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
7274
"Enable leader election for controller manager. "+
7375
"Enabling this will ensure there is only one active controller manager.")
74-
flag.BoolVar(&secureMetrics, "metrics-secure", false,
75-
"If set the metrics endpoint is served securely")
76+
flag.BoolVar(&secureMetrics, "metrics-secure", true,
77+
"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
7678
flag.BoolVar(&enableHTTP2, "enable-http2", false,
7779
"If set, HTTP/2 will be enabled for the metrics and webhook servers")
7880
opts := zap.Options{
@@ -95,7 +97,6 @@ func main() {
9597
c.NextProtos = []string{"http/1.1"}
9698
}
9799

98-
tlsOpts := []func(*tls.Config){}
99100
if !enableHTTP2 {
100101
tlsOpts = append(tlsOpts, disableHTTP2)
101102
}
@@ -104,13 +105,33 @@ func main() {
104105
TLSOpts: tlsOpts,
105106
})
106107

108+
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
109+
// More info:
110+
// - https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/server
111+
// - https://book.kubebuilder.io/reference/metrics.html
112+
metricsServerOptions := metricsserver.Options{
113+
BindAddress: metricsAddr,
114+
SecureServing: secureMetrics,
115+
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
116+
// not provided, self-signed certificates will be generated by default. This option is not recommended for
117+
// production environments as self-signed certificates do not offer the same level of trust and security
118+
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
119+
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
120+
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
121+
TLSOpts: tlsOpts,
122+
}
123+
124+
if secureMetrics {
125+
// FilterProvider is used to protect the metrics endpoint with authn/authz.
126+
// These configurations ensure that only authorized users and service accounts
127+
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
128+
// https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization
129+
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
130+
}
131+
107132
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
108-
Scheme: scheme,
109-
Metrics: metricsserver.Options{
110-
BindAddress: metricsAddr,
111-
SecureServing: secureMetrics,
112-
TLSOpts: tlsOpts,
113-
},
133+
Scheme: scheme,
134+
Metrics: metricsServerOptions,
114135
WebhookServer: webhookServer,
115136
HealthProbeBindAddress: probeAddr,
116137
LeaderElection: enableLeaderElection,

‎config/default/kustomization.yaml‎

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -25,20 +25,16 @@ resources:
2525
#- ../certmanager
2626
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
2727
#- ../prometheus
28-
# [METRICS] To enable the controller manager metrics service, uncomment the following line.
29-
#- metrics_service.yaml
30-
31-
patches:
32-
- path: manager_env_patch.yaml
28+
# [METRICS] Expose the controller manager metrics service.
29+
- metrics_service.yaml
3330

3431
# Uncomment the patches line if you enable Metrics, and/or are using webhooks and cert-manager
35-
#patches:
36-
# [METRICS] The following patch will enable the metrics endpoint. Ensure that you also protect this endpoint.
32+
patches:
33+
# [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443.
3734
# More info: https://book.kubebuilder.io/reference/metrics
38-
# If you want to expose the metric endpoint of your controller-manager uncomment the following line.
39-
#- path: manager_metrics_patch.yaml
40-
# target:
41-
# kind: Deployment
35+
- path: manager_metrics_patch.yaml
36+
target:
37+
kind: Deployment
4238

4339
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
4440
# crd/kustomization.yaml
@@ -49,6 +45,8 @@ patches:
4945
# 'CERTMANAGER' needs to be enabled to use ca injection
5046
#- path: webhookcainjection_patch.yaml
5147

48+
- path: manager_env_patch.yaml
49+
5250
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
5351
# Uncomment the following replacements to add the cert-manager CA injection annotations
5452
#replacements:

‎config/default/manager_metrics_patch.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# This patch adds the args to allow exposing the metrics endpoint securely
1+
# This patch adds the args to allow exposing the metrics endpoint using HTTPS
22
- op: add
33
path: /spec/template/spec/containers/0/args/0
4-
value: --metrics-bind-address=:8080
4+
value: --metrics-bind-address=:8443

‎config/default/metrics_service.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ metadata:
99
namespace: system
1010
spec:
1111
ports:
12-
- name: http
13-
port: 8080
12+
- name: https
13+
port: 8443
1414
protocol: TCP
15-
targetPort: 8080
15+
targetPort: 8443
1616
selector:
1717
control-plane: controller-manager

‎config/prometheus/monitor.yaml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,20 @@ metadata:
1111
spec:
1212
endpoints:
1313
- path: /metrics
14-
port: http # Ensure this is the name of the port that exposes HTTP metrics
15-
scheme: http
14+
port: https # Ensure this is the name of the port that exposes HTTPS metrics
15+
scheme: https
16+
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
17+
tlsConfig:
18+
# TODO(user): The option insecureSkipVerify: true is not recommended for production since it disables
19+
# certificate verification. This poses a significant security risk by making the system vulnerable to
20+
# man-in-the-middle attacks, where an attacker could intercept and manipulate the communication between
21+
# Prometheus and the monitored services. This could lead to unauthorized access to sensitive metrics data,
22+
# compromising the integrity and confidentiality of the information.
23+
# Please use the following options for secure configurations:
24+
# caFile: /etc/metrics-certs/ca.crt
25+
# certFile: /etc/metrics-certs/tls.crt
26+
# keyFile: /etc/metrics-certs/tls.key
27+
insecureSkipVerify: true
1628
selector:
1729
matchLabels:
1830
control-plane: controller-manager

‎config/rbac/kustomization.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,15 @@ resources:
99
- role_binding.yaml
1010
- leader_election_role.yaml
1111
- leader_election_role_binding.yaml
12+
# The following RBAC configurations are used to protect
13+
# the metrics endpoint with authn/authz. These configurations
14+
# ensure that only authorized users and service accounts
15+
# can access the metrics endpoint. Comment the following
16+
# permissions if you want to disable this protection.
17+
# More info: https://book.kubebuilder.io/reference/metrics.html
18+
- metrics_auth_role.yaml
19+
- metrics_auth_role_binding.yaml
20+
- metrics_reader_role.yaml
1221
# For each CRD, "Editor" and "Viewer" roles are scaffolded by
1322
# default, aiding admins in cluster management. Those roles are
1423
# not used by the Project itself. You can comment the following lines

‎config/rbac/metrics_auth_role.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: metrics-auth-role
5+
rules:
6+
- apiGroups:
7+
- authentication.k8s.io
8+
resources:
9+
- tokenreviews
10+
verbs:
11+
- create
12+
- apiGroups:
13+
- authorization.k8s.io
14+
resources:
15+
- subjectaccessreviews
16+
verbs:
17+
- create

‎config/rbac/metrics_auth_role_binding.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: metrics-auth-rolebinding
5+
roleRef:
6+
apiGroup: rbac.authorization.k8s.io
7+
kind: ClusterRole
8+
name: metrics-auth-role
9+
subjects:
10+
- kind: ServiceAccount
11+
name: controller-manager
12+
namespace: system

‎config/rbac/metrics_reader_role.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: metrics-reader
5+
rules:
6+
- nonResourceURLs:
7+
- "/metrics"
8+
verbs:
9+
- get

0 commit comments

Comments
 (0)