[release-4.20] OCPBUGS-79463: Implement mTLS authentication and authorization for CVO metrics endpoint#1374

Open

DavidHurta wants to merge 13 commits intoopenshift:release-4.20from

DavidHurta:backport-metrics-mtls-release-4.20

Commits on Apr 13, 2026

pkg/cvo/metrics: Utilize dynamiccertificates package for certificate updates

DavidHurta
and
claude
committed
pkg/cvo/metrics: Authenticate clients using mTLS

DavidHurta
and
claude
committed
install/servicemonitor: Instruct Prometheus to use mTLS instead of bearer token
DavidHurta
committed
pkg/cvo/metrics: Authorize using CN verification

DavidHurta
and
claude
committed
pkg/start/start: Use directly HyperShift flag
DavidHurta
committed
pkg: Introduce options to disable granularly authn/authz for metrics
DavidHurta
committed
pkg/cvo/metrics: Fix error returned when listen address is empty
DavidHurta
committed
pkg/cvo/metrics: Log certificate controller events into stdout
DavidHurta
committed
pkg/cvo/metrics: Add more fields to MetricsOptions
DavidHurta
committed
metrics: Populate MetricsOptions at startup
DavidHurta
committed
pkg/cvo/metrics: Authenticate in application layer
DavidHurta
committed
Run `go mod tidy & go mod vendor`
DavidHurta
committed
pkg/cvo/metrics: crypto.MakeSelfSignedCAConfig requires argument in days
DavidHurta
committed