Skip to content

Commit 4e32c43

Browse files
acornett21acornett21
committed
updating to operator-sdk 1.39 and kubebuilder v4 scaffolding
Signed-off-by: Adam D. Cornett <adc@redhat.com>
1 parent 51a3250 commit 4e32c43

17 files changed

Lines changed: 162 additions & 75 deletions

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,7 @@ OPERATOR_SDK ?= $(LOCALBIN)/operator-sdk
194194
KUSTOMIZE_VERSION ?= v5.4.3
195195
CONTROLLER_TOOLS_VERSION ?= v0.16.1
196196
ENVTEST_VERSION ?= release-0.19
197-
OPERATOR_SDK_VERSION ?= "v1.36.0"
197+
OPERATOR_SDK_VERSION ?= "v1.39.0"
198198
KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
199199
.PHONY: kustomize
200200
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary. If wrong version is installed, it will be removed before downloading.

‎cmd/main.go‎

Lines changed: 45 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ limitations under the License.
1717
package main
1818

1919
import (
20+
"crypto/tls"
2021
"flag"
2122
"os"
2223

@@ -37,6 +38,7 @@ import (
3738
ctrl "sigs.k8s.io/controller-runtime"
3839
"sigs.k8s.io/controller-runtime/pkg/healthz"
3940
"sigs.k8s.io/controller-runtime/pkg/log/zap"
41+
"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
4042
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
4143
// +kubebuilder:scaffold:imports
4244
)
@@ -63,11 +65,19 @@ func main() {
6365
var metricsAddr string
6466
var enableLeaderElection bool
6567
var probeAddr string
66-
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
68+
var secureMetrics bool
69+
var enableHTTP2 bool
70+
var tlsOpts []func(*tls.Config)
71+
flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
72+
"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
6773
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
6874
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
6975
"Enable leader election for controller manager. "+
7076
"Enabling this will ensure there is only one active controller manager.")
77+
flag.BoolVar(&secureMetrics, "metrics-secure", true,
78+
"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
79+
flag.BoolVar(&enableHTTP2, "enable-http2", false,
80+
"If set, HTTP/2 will be enabled for the metrics and webhook servers")
7181
opts := zap.Options{
7282
Development: true,
7383
}
@@ -76,12 +86,45 @@ func main() {
7686

7787
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
7888

89+
// if the enable-http2 flag is false (the default), http/2 should be disabled
90+
// due to its vulnerabilities. More specifically, disabling http/2 will
91+
// prevent from being vulnerable to the HTTP/2 Stream Cancellation and
92+
// Rapid Reset CVEs. For more information see:
93+
// - https://github.com/advisories/GHSA-qppj-fm5r-hxr3
94+
// - https://github.com/advisories/GHSA-4374-p667-p6c8
95+
disableHTTP2 := func(c *tls.Config) {
96+
setupLog.Info("disabling http/2")
97+
c.NextProtos = []string{"http/1.1"}
98+
}
99+
100+
if !enableHTTP2 {
101+
tlsOpts = append(tlsOpts, disableHTTP2)
102+
}
103+
104+
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
105+
// More info:
106+
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.0/pkg/metrics/server
107+
// - https://book.kubebuilder.io/reference/metrics.html
108+
metricsServerOptions := metricsserver.Options{
109+
BindAddress: metricsAddr,
110+
SecureServing: secureMetrics,
111+
TLSOpts: tlsOpts,
112+
}
113+
114+
if secureMetrics {
115+
// FilterProvider is used to protect the metrics endpoint with authn/authz.
116+
// These configurations ensure that only authorized users and service accounts
117+
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
118+
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.0/pkg/metrics/filters#WithAuthenticationAndAuthorization
119+
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
120+
}
121+
79122
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
80123
Scheme: scheme,
81124
HealthProbeBindAddress: probeAddr,
82125
LeaderElection: enableLeaderElection,
83126
LeaderElectionID: "ef59679f.redhat.com",
84-
Metrics: metricsserver.Options{BindAddress: metricsAddr},
127+
Metrics: metricsServerOptions,
85128
})
86129
if err != nil {
87130
setupLog.Error(err, "unable to start manager")

‎config/default/kustomization.yaml‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,21 @@ resources:
2525
#- ../certmanager
2626
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
2727
#- ../prometheus
28+
# [METRICS] Expose the controller manager metrics service.
29+
- metrics_service.yaml
30+
# [NETWORK POLICY] Protect the /metrics endpoint and Webhook Server with NetworkPolicy.
31+
# Only Pod(s) running a namespace labeled with 'metrics: enabled' will be able to gather the metrics.
32+
# Only CR(s) which requires webhooks and are applied on namespaces labeled with 'webhooks: enabled' will
33+
# be able to communicate with the Webhook Server.
34+
#- ../network-policy
2835

29-
# Protect the /metrics endpoint by putting it behind auth.
30-
# If you want your controller-manager to expose the /metrics
31-
# endpoint w/o any authn/z, please comment the following line.
32-
apiVersion: kustomize.config.k8s.io/v1beta1
33-
kind: Kustomization
36+
# Uncomment the patches line if you enable Metrics, and/or are using webhooks and cert-manager
3437
patches:
35-
- path: manager_auth_proxy_patch.yaml
38+
# [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443.
39+
# More info: https://book.kubebuilder.io/reference/metrics
40+
- path: manager_metrics_patch.yaml
41+
target:
42+
kind: Deployment
3643

3744
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
3845
# crd/kustomization.yaml

‎config/default/manager_auth_proxy_patch.yaml‎

Lines changed: 0 additions & 34 deletions
This file was deleted.

‎config/default/manager_config_patch.yaml‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎config/default/manager_metrics_patch.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# This patch adds the args to allow exposing the metrics endpoint using HTTPS
2+
- op: add
3+
path: /spec/template/spec/containers/0/args/0
4+
value: --metrics-bind-address=:8443

config/rbac/auth_proxy_service.yaml renamed to config/default/metrics_service.yaml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,15 @@ kind: Service
33
metadata:
44
labels:
55
control-plane: controller-manager
6+
app.kubernetes.io/name: memcached-operator
7+
app.kubernetes.io/managed-by: kustomize
68
name: controller-manager-metrics-service
79
namespace: system
810
spec:
911
ports:
1012
- name: https
1113
port: 8443
1214
protocol: TCP
13-
targetPort: https
15+
targetPort: 8443
1416
selector:
1517
control-plane: controller-manager

‎config/manager/manager.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ spec:
3131
- /manager
3232
args:
3333
- --leader-elect
34+
- --health-probe-bind-address=:8081
3435
image: controller:latest
3536
imagePullPolicy: Always
3637
name: manager

‎config/network-policy/allow-metrics-traffic.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# This NetworkPolicy allows ingress traffic
2+
# with Pods running on namespaces labeled with 'metrics: enabled'. Only Pods on those
3+
# namespaces are able to gathering data from the metrics endpoint.
4+
apiVersion: networking.k8s.io/v1
5+
kind: NetworkPolicy
6+
metadata:
7+
labels:
8+
app.kubernetes.io/name: memcached-operator
9+
app.kubernetes.io/managed-by: kustomize
10+
name: allow-metrics-traffic
11+
namespace: system
12+
spec:
13+
podSelector:
14+
matchLabels:
15+
control-plane: controller-manager
16+
policyTypes:
17+
- Ingress
18+
ingress:
19+
# This allows ingress traffic from any namespace with the label metrics: enabled
20+
- from:
21+
- namespaceSelector:
22+
matchLabels:
23+
metrics: enabled # Only from namespaces with this label
24+
ports:
25+
- port: 8443
26+
protocol: TCP

‎config/network-policy/kustomization.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
resources:
2+
- allow-metrics-traffic.yaml

0 commit comments

Comments
 (0)