Skip to content

Drop kube-rbac-proxy container config for metrics#177

Merged
hardikdr merged 1 commit intoironcore-dev:mainfrom
opensovereigncloud:osc/enh/replace-kube-rbac-proxy
May 13, 2025
Merged

Drop kube-rbac-proxy container config for metrics#177
hardikdr merged 1 commit intoironcore-dev:mainfrom
opensovereigncloud:osc/enh/replace-kube-rbac-proxy

Conversation

@Rohit-0505
Copy link
Copy Markdown
Contributor

@Rohit-0505 Rohit-0505 commented Apr 16, 2025

The PR removes the soon-to-be deprecated kube-rbac-proxy container dependency and replaces it with Controller-Runtime's built-in authn/authz for securing the metrics endpoint. This simplifies setup, enhances security, and follows the latest Kubebuilder best practices.

Key Changes

  • Removed kube-rbac-proxy dependency.
  • Enabled Controller-Runtime's built-in authentication & authorization for metrics.
  • Enhanced cert-manager integration to secure metrics with TLS encryption.
  • Added e2e tests to validate the metrics endpoint

Fixes #108

Ref for reviewer (The link below has the discussions and steps to be follwed)
kubernetes-sigs/kubebuilder#3907

@Rohit-0505 Rohit-0505 requested a review from a team as a code owner April 16, 2025 08:38
@github-actions github-actions Bot added documentation Improvements or additions to documentation enhancement New feature or request labels Apr 16, 2025
@Rohit-0505 Rohit-0505 self-assigned this Apr 16, 2025
Copy link
Copy Markdown
Member

@hardikdr hardikdr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Rohit-0505 Thanks for the PR!
I see there are significant changes — have you been able to test them end-to-end?
Also, are these changes aligned with any other project within ironcore-dev (e.g., metal-operator)? If so, could you please link the related PR here?

@Rohit-0505
Copy link
Copy Markdown
Contributor Author

@Rohit-0505 Thanks for the PR! I see there are significant changes — have you been able to test them end-to-end? Also, are these changes aligned with any other project within ironcore-dev (e.g., metal-operator)? If so, could you please link the related PR here?

To perform the e2e-test, I have followed the kubebuilder approach for testing the metrics endpoint validation, and a github workflow is also added in this PR for e2e-test
Here is the reference PR from metal-operator ironcore-dev/metal-operator#243

@hardikdr hardikdr added this to Roadmap May 4, 2025
@hardikdr hardikdr moved this to In Progress in Roadmap May 7, 2025
hardikdr
hardikdr previously approved these changes May 12, 2025
Copy link
Copy Markdown
Member

@hardikdr hardikdr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @Rohit-0505, the workflow is helpful.

Copy link
Copy Markdown
Member

@hardikdr hardikdr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please resolve the conflicts with the main branch, and we are good to go then.

@opensovereigncloud-user opensovereigncloud-user force-pushed the osc/enh/replace-kube-rbac-proxy branch 2 times, most recently from fb93bb5 to c06b60a Compare May 12, 2025 08:43
@opensovereigncloud-user opensovereigncloud-user force-pushed the osc/enh/replace-kube-rbac-proxy branch from c06b60a to 68e2e1a Compare May 12, 2025 08:52
@Rohit-0505
Copy link
Copy Markdown
Contributor Author

Can you please resolve the conflicts with the main branch, and we are good to go then.

PR is rebased and resolved all conflicts.

@hardikdr hardikdr merged commit 6a674a3 into ironcore-dev:main May 13, 2025
8 checks passed
@github-project-automation github-project-automation Bot moved this from In Progress to Done in Roadmap May 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/metal-automation documentation Improvements or additions to documentation enhancement New feature or request

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

Drop usage of kube-rbac-proxy

2 participants