feat: add flag to enable anonymous metrics access by jindijamie · Pull Request #3110 · kubernetes-sigs/security-profiles-operator

jindijamie · 2026-03-07T00:14:54Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

Allow metrics access without authentication.
The default behavior is still require authentication.

Which issue(s) this PR fixes:

Does this PR have test?

N/A

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Add --enable-insecure-metrics-access flag for unauthenticated/unencrypted
  metrics access; default secure behavior remains unchanged.

k8s-ci-robot · 2026-03-07T00:15:05Z

Hi @jindijamie. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

codecov-commenter · 2026-03-07T00:22:29Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 24.64%. Comparing base (11d77f4) to head (ea5631e).
⚠️ Report is 1123 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #3110       +/-   ##
===========================================
- Coverage   45.50%   24.64%   -20.86%     
===========================================
  Files          79      126       +47     
  Lines        7782    17992    +10210     
===========================================
+ Hits         3541     4435      +894     
- Misses       4099    13265     +9166     
- Partials      142      292      +150

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

k8s-ci-robot · 2026-03-10T12:35:33Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ccojocar, jindijamie

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [ccojocar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jindijamie · 2026-03-31T21:41:55Z

/release-note-none

k8s-ci-robot · 2026-03-31T21:47:45Z

New changes are detected. LGTM label has been removed.

jindijamie · 2026-04-03T22:50:02Z

/retest

k8s-ci-robot · 2026-04-03T22:50:18Z

@jindijamie: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

jindijamie · 2026-04-08T18:29:52Z

/retest

k8s-ci-robot · 2026-04-08T18:30:07Z

@jindijamie: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

saschagrunert · 2026-05-05T14:02:43Z

/ok-to-test

saschagrunert

Follow-up review. The flag rename to enable-insecure-metrics-access and the release note address the previous round's concerns, but a few issues remain, one of them significant.

Also: the three commits ("feat: add flag...", "Update the name...", "Fix lint issue") should be squashed into one.

saschagrunert · 2026-05-05T14:07:51Z

+	if ctx.Bool(enableInsecureMetricsAccessFlag) {
+		setupLog.Info("Insecure metrics access allowed (TLS and authentication disabled)")
+
+		metricsOptions.SecureServing = false


This flag is defined and consumed in runDaemon, but there's no mechanism to propagate it to the spod daemonset. The operator manages the daemonset; users can't set env vars on it directly without the operator overwriting them on the next reconciliation.

The established pattern (see EnableProfiling in api/spod/v1alpha1/spod_types.go:289 and spod_controller.go:773) is:

Add a field to SPODSpec (e.g. EnableInsecureMetricsAccess bool)

Read it in the spod controller and inject ENABLE_INSECURE_METRICS_ACCESS as an env var into the daemon container

Without this integration, the flag is unusable in a standard SPO deployment.

saschagrunert · 2026-05-05T14:07:51Z

+		&cli.BoolFlag{
+			Name:    enableInsecureMetricsAccessFlag,
+			Usage:   "enable insecure metrics access (disables TLS and authentication)",
+			EnvVars: []string{config.EnableInsecureMetricsAccessEnvKey},
+		},


This flag is only consumed in runDaemon but is registered as a global flag. All other daemon-specific feature flags (seccompFlag, selinuxFlag, recordingFlag, memOptimFlag) are registered under the daemon subcommand's flags (lines 185-212). Move it there for consistency.

saschagrunert · 2026-05-05T14:07:51Z

+	}
+
+	if ctx.Bool(enableInsecureMetricsAccessFlag) {
+		setupLog.Info("Insecure metrics access allowed (TLS and authentication disabled)")


Follow-up from the previous round: since there's no warning level on setupLog, consider making the message stand out by prefixing it:

Suggested change

setupLog.Info("Insecure metrics access allowed (TLS and authentication disabled)")

setupLog.Info("WARNING: Insecure metrics access enabled, TLS and authentication disabled")

saschagrunert · 2026-05-05T14:07:52Z

+	// EnableInsecureMetricsAccessEnvKey is the environment variable key for enabling insecure
+	// metrics access(disables TLS and authentication).


Missing space before parenthesis.

Suggested change

// EnableInsecureMetricsAccessEnvKey is the environment variable key for enabling insecure

// metrics access(disables TLS and authentication).

// EnableInsecureMetricsAccessEnvKey is the environment variable key for enabling insecure

// metrics access (disables TLS and authentication).

k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 7, 2026

k8s-ci-robot requested review from Vincent056 and ngopalak-redhat March 7, 2026 00:15

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Mar 7, 2026

k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Mar 7, 2026

jindijamie force-pushed the enable-anonymous-metrics branch 2 times, most recently from 52216f8 to e3ba267 Compare March 10, 2026 00:28

ccojocar approved these changes Mar 10, 2026

View reviewed changes

k8s-ci-robot assigned ccojocar Mar 10, 2026

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Mar 10, 2026

k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Mar 31, 2026

feat: add flag to enable anonymous metrics access

6f0acb9

jindijamie force-pushed the enable-anonymous-metrics branch from e3ba267 to 6f0acb9 Compare March 31, 2026 21:47

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 31, 2026

saschagrunert reviewed Apr 1, 2026

View reviewed changes

Comment thread cmd/security-profiles-operator/main.go Outdated

Comment thread cmd/security-profiles-operator/main.go

Comment thread internal/pkg/config/config.go Outdated

Update the name to enable-insecure-metrics-access

3edca39

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Apr 2, 2026

Fix lint issue

ea5631e

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 5, 2026

saschagrunert reviewed May 5, 2026

View reviewed changes

	setupLog.Info("Insecure metrics access allowed (TLS and authentication disabled)")
	setupLog.Info("WARNING: Insecure metrics access enabled, TLS and authentication disabled")

		// EnableInsecureMetricsAccessEnvKey is the environment variable key for enabling insecure
		// metrics access(disables TLS and authentication).

Conversation

jindijamie commented Mar 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Does this PR have test?

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

k8s-ci-robot commented Mar 7, 2026

Uh oh!

codecov-commenter commented Mar 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

k8s-ci-robot commented Mar 10, 2026

Uh oh!

jindijamie commented Mar 31, 2026

Uh oh!

k8s-ci-robot commented Mar 31, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jindijamie commented Apr 3, 2026

Uh oh!

k8s-ci-robot commented Apr 3, 2026

Uh oh!

jindijamie commented Apr 8, 2026

Uh oh!

k8s-ci-robot commented Apr 8, 2026

Uh oh!

saschagrunert commented May 5, 2026

Uh oh!

saschagrunert left a comment

Choose a reason for hiding this comment

Uh oh!

saschagrunert May 5, 2026

Choose a reason for hiding this comment

Uh oh!

saschagrunert May 5, 2026

Choose a reason for hiding this comment

Uh oh!

saschagrunert May 5, 2026

Choose a reason for hiding this comment

Uh oh!

saschagrunert May 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jindijamie commented Mar 7, 2026 •

edited

Loading

codecov-commenter commented Mar 7, 2026 •

edited

Loading