Skip to content

Commit f7fde1f

Browse files
danielorbachdanielorbach
committed
feat(helm): add RBAC for authenticated controller metrics scrapes
The controller manager already wires controller-runtime's WithAuthenticationAndAuthorization filter on the metrics endpoint when --metrics-secure is true (the default). For that filter to validate incoming scrape requests it needs permission to issue TokenReview and SubjectAccessReview calls; ship those rights as a dedicated auth role bound to the controller ServiceAccount. Also ship an unbound `<fullname>-metrics-reader` ClusterRole granting `get` on the `/metrics` non-resource URL. The chart deliberately leaves the binding to the cluster operator: which ServiceAccount (Prometheus, VictoriaMetrics, OpenTelemetry, etc.) is allowed to scrape is a deployment-time choice, not a chart-time one. The auth role and its binding are gated additionally on `controller.metrics.secureServing` since they are no-ops when the filter is disabled. All resources are gated on `controller.metrics.enabled` and default off.
1 parent ff7de29 commit f7fde1f

4 files changed

Lines changed: 163 additions & 0 deletions

File tree

‎helm/kagent/templates/rbac/metrics-auth-clusterrole.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.secureServing }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: {{ include "kagent.fullname" . }}-metrics-auth-role
6+
labels:
7+
{{- include "kagent.controller.labels" . | nindent 4 }}
8+
rules:
9+
- apiGroups:
10+
- authentication.k8s.io
11+
resources:
12+
- tokenreviews
13+
verbs:
14+
- create
15+
- apiGroups:
16+
- authorization.k8s.io
17+
resources:
18+
- subjectaccessreviews
19+
verbs:
20+
- create
21+
{{- end }}

‎helm/kagent/templates/rbac/metrics-auth-clusterrolebinding.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.secureServing }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRoleBinding
4+
metadata:
5+
name: {{ include "kagent.fullname" . }}-metrics-auth-rolebinding
6+
labels:
7+
{{- include "kagent.controller.labels" . | nindent 4 }}
8+
roleRef:
9+
apiGroup: rbac.authorization.k8s.io
10+
kind: ClusterRole
11+
name: {{ include "kagent.fullname" . }}-metrics-auth-role
12+
subjects:
13+
- kind: ServiceAccount
14+
name: {{ include "kagent.fullname" . }}-controller
15+
namespace: {{ include "kagent.namespace" . }}
16+
{{- end }}

‎helm/kagent/templates/rbac/metrics-reader-clusterrole.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if .Values.controller.metrics.enabled }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: {{ include "kagent.fullname" . }}-metrics-reader
6+
labels:
7+
{{- include "kagent.controller.labels" . | nindent 4 }}
8+
rules:
9+
- nonResourceURLs:
10+
- "/metrics"
11+
verbs:
12+
- get
13+
{{- end }}

‎helm/kagent/tests/controller-metrics-rbac_test.yaml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
suite: test controller metrics rbac
2+
templates:
3+
- rbac/metrics-reader-clusterrole.yaml
4+
- rbac/metrics-auth-clusterrole.yaml
5+
- rbac/metrics-auth-clusterrolebinding.yaml
6+
tests:
7+
- it: should not render any metrics rbac by default
8+
asserts:
9+
- hasDocuments:
10+
count: 0
11+
template: rbac/metrics-reader-clusterrole.yaml
12+
- hasDocuments:
13+
count: 0
14+
template: rbac/metrics-auth-clusterrole.yaml
15+
- hasDocuments:
16+
count: 0
17+
template: rbac/metrics-auth-clusterrolebinding.yaml
18+
19+
- it: should render metrics-reader when metrics enabled
20+
set:
21+
controller.metrics.enabled: true
22+
template: rbac/metrics-reader-clusterrole.yaml
23+
asserts:
24+
- isKind:
25+
of: ClusterRole
26+
- equal:
27+
path: metadata.name
28+
value: RELEASE-NAME-metrics-reader
29+
- equal:
30+
path: rules[0].nonResourceURLs[0]
31+
value: /metrics
32+
- equal:
33+
path: rules[0].verbs[0]
34+
value: get
35+
36+
- it: should render auth role and binding when secure serving enabled
37+
set:
38+
controller.metrics.enabled: true
39+
asserts:
40+
- isKind:
41+
of: ClusterRole
42+
template: rbac/metrics-auth-clusterrole.yaml
43+
- equal:
44+
path: metadata.name
45+
value: RELEASE-NAME-metrics-auth-role
46+
template: rbac/metrics-auth-clusterrole.yaml
47+
- isKind:
48+
of: ClusterRoleBinding
49+
template: rbac/metrics-auth-clusterrolebinding.yaml
50+
- equal:
51+
path: metadata.name
52+
value: RELEASE-NAME-metrics-auth-rolebinding
53+
template: rbac/metrics-auth-clusterrolebinding.yaml
54+
55+
- it: auth role should grant token and subject access reviews
56+
set:
57+
controller.metrics.enabled: true
58+
template: rbac/metrics-auth-clusterrole.yaml
59+
asserts:
60+
- equal:
61+
path: rules[0].apiGroups[0]
62+
value: authentication.k8s.io
63+
- equal:
64+
path: rules[0].resources[0]
65+
value: tokenreviews
66+
- equal:
67+
path: rules[0].verbs[0]
68+
value: create
69+
- equal:
70+
path: rules[1].apiGroups[0]
71+
value: authorization.k8s.io
72+
- equal:
73+
path: rules[1].resources[0]
74+
value: subjectaccessreviews
75+
- equal:
76+
path: rules[1].verbs[0]
77+
value: create
78+
79+
- it: auth rolebinding should reference controller serviceaccount
80+
set:
81+
controller.metrics.enabled: true
82+
template: rbac/metrics-auth-clusterrolebinding.yaml
83+
asserts:
84+
- equal:
85+
path: roleRef.kind
86+
value: ClusterRole
87+
- equal:
88+
path: roleRef.name
89+
value: RELEASE-NAME-metrics-auth-role
90+
- equal:
91+
path: subjects[0].kind
92+
value: ServiceAccount
93+
- equal:
94+
path: subjects[0].name
95+
value: RELEASE-NAME-controller
96+
- equal:
97+
path: subjects[0].namespace
98+
value: NAMESPACE
99+
100+
- it: should skip auth role when secure serving disabled
101+
set:
102+
controller.metrics.enabled: true
103+
controller.metrics.secureServing: false
104+
asserts:
105+
- hasDocuments:
106+
count: 1
107+
template: rbac/metrics-reader-clusterrole.yaml
108+
- hasDocuments:
109+
count: 0
110+
template: rbac/metrics-auth-clusterrole.yaml
111+
- hasDocuments:
112+
count: 0
113+
template: rbac/metrics-auth-clusterrolebinding.yaml

0 commit comments

Comments
 (0)