Skip to content

feat(http-add-on): replace kube-rbac-proxy with native secure metrics#807

Merged
wozniakjan merged 1 commit intokedacore:mainfrom
linkvt:http-add-on-native-secure-metrics
Jan 28, 2026
Merged

feat(http-add-on): replace kube-rbac-proxy with native secure metrics#807
wozniakjan merged 1 commit intokedacore:mainfrom
linkvt:http-add-on-native-secure-metrics

Conversation

@linkvt
Copy link
Contributor

@linkvt linkvt commented Jan 22, 2026

The kube-rbac-proxy sidecar is being discontinued and its images will become unavailable. This change uses controller-runtime's built-in metrics authentication instead, following kubebuilder recommendations, see kedacore/http-add-on#1369 .

Changes

  • Remove kube-rbac-proxy sidecar container from operator deployment
  • Add operator.metrics config (secure, auth, certDir) to values.yaml
    • The metrics endpoint defaults to being secure and requiring auth right now
    • We should IMO change the defaults later to match theones from the related PR to be insecure and without auth by default
    • Let me know if you're fine with changing the defaults now
  • Replace proxy-role ClusterRole with system:auth-delegator binding
  • Remove kube-rbac-proxy image and securityContext references

I tested accessing the metrics locally with the latest operator based on the main branch, worked well.

Checklist

  • I have verified that my change is according to the deprecations & breaking changes policy
  • Commits are signed with Developer Certificate of Origin (DCO - learn more)
  • README is updated with new configuration values (if applicable) learn more
  • A PR is opened to update KEDA core (repo) (if applicable, ie. when deployment manifests are modified)

fyi @khauser , maybe you would like to test the chart

The kube-rbac-proxy sidecar is being discontinued and its images will
become unavailable. This change uses controller-runtime's built-in
metrics authentication instead, following kubebuilder recommendations.

Changes:
- Remove kube-rbac-proxy sidecar container from operator deployment
- Add operator.metrics config (secure, auth, certDir) to values.yaml
- Replace proxy-role ClusterRole with system:auth-delegator binding
- Remove kube-rbac-proxy image and securityContext references

Signed-off-by: Vincent Link <[email protected]>
@linkvt linkvt requested a review from a team as a code owner January 22, 2026 12:25
@khauser
Copy link

khauser commented Jan 22, 2026

@linkvt : Very nice that you were integrating it 👍

Didn't we need also to release a new version of the addon and add it to the Chart.yaml und appVersion?

@linkvt
Copy link
Contributor Author

linkvt commented Jan 22, 2026

Thanks!
Yes, updates to the Chart.yaml will happen when the release is triggered as far as I understand https://github.com/kedacore/charts/blob/main/CONTRIBUTING.md#shipping-a-new-version

We plan to release the next version probably next week.

@linkvt linkvt mentioned this pull request Jan 28, 2026
7 tasks
@wozniakjan wozniakjan merged commit d8d272c into kedacore:main Jan 28, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants