Skip to content

Commit 6c8c9e3

Browse files
github-actions[bot]github-actions[bot]
committed
Generated by GitHub Actions (scaffold / create)
https://github.com/int128/kubebuilder-updates/actions/runs/9807173277
1 parent 84a5aa8 commit 6c8c9e3

File tree

13 files changed

+192
-36
lines changed

13 files changed

+192
-36
lines changed

‎.golangci.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,14 @@ linters:
3434
- misspell
3535
- nakedret
3636
- prealloc
37+
- revive
3738
- staticcheck
3839
- typecheck
3940
- unconvert
4041
- unparam
4142
- unused
43+
44+
linters-settings:
45+
revive:
46+
rules:
47+
- name: comment-spacings

‎cmd/main.go‎

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ import (
3131
ctrl "sigs.k8s.io/controller-runtime"
3232
"sigs.k8s.io/controller-runtime/pkg/healthz"
3333
"sigs.k8s.io/controller-runtime/pkg/log/zap"
34+
"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
3435
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
3536
"sigs.k8s.io/controller-runtime/pkg/webhook"
3637

@@ -57,14 +58,14 @@ func main() {
5758
var probeAddr string
5859
var secureMetrics bool
5960
var enableHTTP2 bool
60-
flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metric endpoint binds to. "+
61-
"Use the port :8080. If not set, it will be 0 in order to disable the metrics server")
61+
flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
62+
"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
6263
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
6364
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
6465
"Enable leader election for controller manager. "+
6566
"Enabling this will ensure there is only one active controller manager.")
66-
flag.BoolVar(&secureMetrics, "metrics-secure", false,
67-
"If set the metrics endpoint is served securely")
67+
flag.BoolVar(&secureMetrics, "metrics-secure", true,
68+
"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
6869
flag.BoolVar(&enableHTTP2, "enable-http2", false,
6970
"If set, HTTP/2 will be enabled for the metrics and webhook servers")
7071
opts := zap.Options{
@@ -97,10 +98,25 @@ func main() {
9798

9899
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
99100
Scheme: scheme,
101+
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
102+
// More info:
103+
// - https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/server
104+
// - https://book.kubebuilder.io/reference/metrics.html
100105
Metrics: metricsserver.Options{
101106
BindAddress: metricsAddr,
102107
SecureServing: secureMetrics,
103-
TLSOpts: tlsOpts,
108+
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
109+
// not provided, self-signed certificates will be generated by default. This option is not recommended for
110+
// production environments as self-signed certificates do not offer the same level of trust and security
111+
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
112+
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
113+
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
114+
TLSOpts: tlsOpts,
115+
// FilterProvider is used to protect the metrics endpoint with authn/authz.
116+
// These configurations ensure that only authorized users and service accounts
117+
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
118+
// https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization
119+
FilterProvider: filters.WithAuthenticationAndAuthorization,
104120
},
105121
WebhookServer: webhookServer,
106122
HealthProbeBindAddress: probeAddr,

‎config/default/kustomization.yaml‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,17 +25,16 @@ resources:
2525
#- ../certmanager
2626
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
2727
#- ../prometheus
28-
# [METRICS] To enable the controller manager metrics service, uncomment the following line.
29-
#- metrics_service.yaml
28+
# [METRICS] Expose the controller manager metrics service.
29+
- metrics_service.yaml
3030

3131
# Uncomment the patches line if you enable Metrics, and/or are using webhooks and cert-manager
32-
#patches:
33-
# [METRICS] The following patch will enable the metrics endpoint. Ensure that you also protect this endpoint.
32+
patches:
33+
# [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443.
3434
# More info: https://book.kubebuilder.io/reference/metrics
35-
# If you want to expose the metric endpoint of your controller-manager uncomment the following line.
36-
#- path: manager_metrics_patch.yaml
37-
# target:
38-
# kind: Deployment
35+
- path: manager_metrics_patch.yaml
36+
target:
37+
kind: Deployment
3938

4039
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
4140
# crd/kustomization.yaml

‎config/default/manager_metrics_patch.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# This patch adds the args to allow exposing the metrics endpoint securely
1+
# This patch adds the args to allow exposing the metrics endpoint using HTTPS
22
- op: add
33
path: /spec/template/spec/containers/0/args/0
4-
value: --metrics-bind-address=:8080
4+
value: --metrics-bind-address=:8443

‎config/default/metrics_service.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ metadata:
99
namespace: system
1010
spec:
1111
ports:
12-
- name: http
13-
port: 8080
12+
- name: https
13+
port: 8443
1414
protocol: TCP
15-
targetPort: 8080
15+
targetPort: 8443
1616
selector:
1717
control-plane: controller-manager

‎config/prometheus/monitor.yaml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,20 @@ metadata:
1111
spec:
1212
endpoints:
1313
- path: /metrics
14-
port: http # Ensure this is the name of the port that exposes HTTP metrics
15-
scheme: http
14+
port: https # Ensure this is the name of the port that exposes HTTPS metrics
15+
scheme: https
16+
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
17+
tlsConfig:
18+
# TODO(user): The option insecureSkipVerify: true is not recommended for production since it disables
19+
# certificate verification. This poses a significant security risk by making the system vulnerable to
20+
# man-in-the-middle attacks, where an attacker could intercept and manipulate the communication between
21+
# Prometheus and the monitored services. This could lead to unauthorized access to sensitive metrics data,
22+
# compromising the integrity and confidentiality of the information.
23+
# Please use the following options for secure configurations:
24+
# caFile: /etc/metrics-certs/ca.crt
25+
# certFile: /etc/metrics-certs/tls.crt
26+
# keyFile: /etc/metrics-certs/tls.key
27+
insecureSkipVerify: true
1628
selector:
1729
matchLabels:
1830
control-plane: controller-manager

‎config/rbac/kustomization.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,15 @@ resources:
99
- role_binding.yaml
1010
- leader_election_role.yaml
1111
- leader_election_role_binding.yaml
12+
# The following RBAC configurations are used to protect
13+
# the metrics endpoint with authn/authz. These configurations
14+
# ensure that only authorized users and service accounts
15+
# can access the metrics endpoint. Comment the following
16+
# permissions if you want to disable this protection.
17+
# More info: https://book.kubebuilder.io/reference/metrics.html
18+
- metrics_auth_role.yaml
19+
- metrics_auth_role_binding.yaml
20+
- metrics_reader_role.yaml
1221
# For each CRD, "Editor" and "Viewer" roles are scaffolded by
1322
# default, aiding admins in cluster management. Those roles are
1423
# not used by the Project itself. You can comment the following lines

‎config/rbac/metrics_auth_role.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: metrics-auth-role
5+
rules:
6+
- apiGroups:
7+
- authentication.k8s.io
8+
resources:
9+
- tokenreviews
10+
verbs:
11+
- create
12+
- apiGroups:
13+
- authorization.k8s.io
14+
resources:
15+
- subjectaccessreviews
16+
verbs:
17+
- create

‎config/rbac/metrics_auth_role_binding.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: metrics-auth-rolebinding
5+
roleRef:
6+
apiGroup: rbac.authorization.k8s.io
7+
kind: ClusterRole
8+
name: metrics-auth-role
9+
subjects:
10+
- kind: ServiceAccount
11+
name: controller-manager
12+
namespace: system

‎config/rbac/metrics_reader_role.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: metrics-reader
5+
rules:
6+
- nonResourceURLs:
7+
- "/metrics"
8+
verbs:
9+
- get

0 commit comments

Comments
 (0)