Skip to content

NE-2739: Migrate operator to native metrics protection with centralized TLS #313

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bentito wants to merge 8 commits into
base: main
Choose a base branch
from
+456,809 −246,919
Open

NE-2739: Migrate operator to native metrics protection with centralized TLS #313

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
d7964e4
NE-2739: Migrate operator to native metrics protection with centraliz…
bentito Jul 14, 2026
90a8938
NE-2739: Regenerate OLM bundle manifests and update vendored dependen…
bentito Jul 14, 2026
f39025f
NE-2739: Fix gosec linter warning for TLS configuration
bentito Jul 14, 2026
f86a5ff
NE-2739: Align test CRD fixture with vendor's updated infrastructure …
bentito Jul 14, 2026
f7530de
NE-2739: Align with EDO by disabling HTTP/2 on the metrics server
bentito Jul 15, 2026
5b48f30
NE-2739: Align Kustomize OLM patches with single-container deployment…
bentito Jul 15, 2026
26970fc
NE-2739: Log skipped TLS groups and remove unrelated files from PR br…
bentito Jul 15, 2026
5750ba9
NE-2739: Fix generate-iam-from-credrequest.sh to be cross-platform an…
bentito Jul 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
The diff you're trying to view is too large. We only load the first 3000 changed files.
2 changes: 1 addition & 1 deletion bundle/manifests/aws-load-balancer-operator-manager-config_v1_configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ data:
health:
healthProbeBindAddress: :8081
metrics:
bindAddress: 127.0.0.1:8080
bindAddress: :8443
webhook:
port: 9443
leaderElection:
Expand Down
30 changes: 3 additions & 27 deletions bundle/manifests/aws-load-balancer-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,35 +252,8 @@ spec:
control-plane: controller-manager
spec:
containers:
- args:
- --secure-listen-address=0.0.0.0:8443
- --upstream=http://127.0.0.1:8080/
- --logtostderr=true
- --v=0
- --http2-disable
image: quay.io/openshift/origin-kube-rbac-proxy:latest
name: kube-rbac-proxy
ports:
- containerPort: 8443
name: https
protocol: TCP
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 5m
memory: 64Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
terminationMessagePolicy: FallbackToLogsOnError
- args:
- --health-probe-bind-address=:8081
- --metrics-bind-address=127.0.0.1:8080
- --leader-elect
- --image=$(RELATED_IMAGE_CONTROLLER)
- --namespace=$(TARGET_NAMESPACE)
Expand Down Expand Up @@ -309,6 +282,9 @@ spec:
- containerPort: 9443
name: webhook-server
protocol: TCP
- containerPort: 8443
name: https
protocol: TCP
readinessProbe:
httpGet:
path: /readyz
Expand Down
5 changes: 0 additions & 5 deletions config/default/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,11 +25,6 @@ bases:
#- ../prometheus

patchesStrategicMerge:
# Protect the /metrics endpoint by putting it behind auth.
# If you want your controller-manager to expose the /metrics
# endpoint w/o any authn/z, please comment the following line.
- manager_auth_proxy_patch.yaml

# Mount the controller config file for loading manager configurations
# through a ComponentConfig type
#- manager_config_patch.yaml
Expand Down
37 changes: 0 additions & 37 deletions config/default/manager_auth_proxy_patch.yaml
View file
Open in desktop

This file was deleted.

1 change: 0 additions & 1 deletion config/default/manager_webhook_patch.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ spec:
template:
spec:
containers:
- name: kube-rbac-proxy
- name: manager
ports:
- containerPort: 9443
Expand Down
2 changes: 1 addition & 1 deletion config/manager/controller_manager_config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ kind: ControllerManagerConfig
health:
healthProbeBindAddress: :8081
metrics:
bindAddress: 127.0.0.1:8080
bindAddress: :8443
webhook:
port: 9443
leaderElection:
Expand Down
5 changes: 4 additions & 1 deletion config/manager/manager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,14 +33,17 @@ spec:
- /manager
args:
- "--health-probe-bind-address=:8081"
- "--metrics-bind-address=127.0.0.1:8080"
- "--leader-elect"
- "--image=$(RELATED_IMAGE_CONTROLLER)"
- "--namespace=$(TARGET_NAMESPACE)"
- "--trusted-ca-configmap=$(TRUSTED_CA_CONFIGMAP_NAME)"
- "--webhook-disable-http2"
image: controller:latest
name: manager
ports:
- containerPort: 8443
name: https
protocol: TCP
securityContext:
allowPrivilegeEscalation: false
capabilities:
Expand Down
2 changes: 1 addition & 1 deletion config/manifests/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ patchesJson6902:
# Remove the manager container's "cert" volumeMount, since OLM will create and mount a set of certs.
# Update the indices in this path if adding or removing containers/volumeMounts in the manager's Deployment.
- op: remove
path: /spec/template/spec/containers/1/volumeMounts/0
path: /spec/template/spec/containers/0/volumeMounts/0
Comment thread
coderabbitai[bot] marked this conversation as resolved.
# Remove the "cert" volume, since OLM will create and mount a set of certs.
# Update the indices in this path if adding or removing volumes in the manager's Deployment.
- op: remove
Expand Down
Loading