Skip to content

Commit 2f9d586

Browse files
mergify[bot]mergify[bot]
authored
Merge pull request #437 from frobware/drop-kube-rbac-proxy
Replace kube-rbac-proxy with controller-runtime's built-in TLS capabilities
2 parents 9ecc49b + 0b6fa45 commit 2f9d586

File tree

962 files changed

+212878
-710
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

962 files changed

+212878
-710
lines changed

‎bundle/manifests/bpfman-agent-metrics-monitor_monitoring.coreos.com_v1_servicemonitor.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: monitoring.coreos.com/v1
2+
kind: ServiceMonitor
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: metrics
6+
app.kubernetes.io/created-by: bpfman-operator
7+
app.kubernetes.io/instance: agent-metrics-monitor
8+
app.kubernetes.io/managed-by: kustomize
9+
app.kubernetes.io/name: agent-metrics-monitor
10+
app.kubernetes.io/part-of: bpfman-operator
11+
name: bpfman-agent-metrics-monitor
12+
spec:
13+
endpoints:
14+
- bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
15+
path: /metrics
16+
port: https-metrics
17+
scheme: https
18+
tlsConfig:
19+
caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
20+
insecureSkipVerify: false
21+
serverName: bpfman-agent-metrics-service.bpfman.svc
22+
selector:
23+
matchLabels:
24+
app.kubernetes.io/component: metrics
25+
app.kubernetes.io/instance: agent-metrics-service
26+
app.kubernetes.io/name: agent-metrics-service

‎bundle/manifests/bpfman-agent-metrics-service_v1_service.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
annotations:
5+
service.beta.openshift.io/serving-cert-secret-name: agent-metrics-tls
6+
creationTimestamp: null
7+
labels:
8+
app.kubernetes.io/component: metrics
9+
app.kubernetes.io/created-by: bpfman-operator
10+
app.kubernetes.io/instance: agent-metrics-service
11+
app.kubernetes.io/managed-by: kustomize
12+
app.kubernetes.io/name: agent-metrics-service
13+
app.kubernetes.io/part-of: bpfman-operator
14+
name: bpfman-agent-metrics-service
15+
spec:
16+
ports:
17+
- name: https-metrics
18+
port: 8443
19+
protocol: TCP
20+
targetPort: https-metrics
21+
selector:
22+
name: bpfman-daemon
23+
status:
24+
loadBalancer: {}

‎bundle/manifests/bpfman-auth-delegator_rbac.authorization.k8s.io_v1_clusterrolebinding.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
creationTimestamp: null
5+
labels:
6+
app.kubernetes.io/component: metrics
7+
app.kubernetes.io/created-by: bpfman-operator
8+
app.kubernetes.io/instance: auth-delegator
9+
app.kubernetes.io/managed-by: kustomize
10+
app.kubernetes.io/name: clusterrolebinding
11+
app.kubernetes.io/part-of: bpfman-operator
12+
name: bpfman-auth-delegator
13+
roleRef:
14+
apiGroup: rbac.authorization.k8s.io
15+
kind: ClusterRole
16+
name: system:auth-delegator
17+
subjects:
18+
- kind: ServiceAccount
19+
name: bpfman-operator
20+
namespace: bpfman
21+
- kind: ServiceAccount
22+
name: bpfman-daemon
23+
namespace: bpfman

‎bundle/manifests/bpfman-config_v1_configmap.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ data:
33
bpfman.agent.healthprobe.addr: :8175
44
bpfman.agent.image: quay.io/bpfman/bpfman-agent:latest
55
bpfman.agent.log.level: info
6-
bpfman.agent.metric.addr: 127.0.0.1:8174
6+
bpfman.agent.metric.addr: :8443
77
bpfman.image: quay.io/bpfman/bpfman:latest
88
bpfman.log.level: info
99
bpfman.toml: |

‎bundle/manifests/bpfman-controller-manager-metrics-monitor_monitoring.coreos.com_v1_servicemonitor.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: monitoring.coreos.com/v1
2+
kind: ServiceMonitor
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: metrics
6+
app.kubernetes.io/created-by: bpfman-operator
7+
app.kubernetes.io/instance: controller-manager-metrics-monitor
8+
app.kubernetes.io/managed-by: kustomize
9+
app.kubernetes.io/name: servicemonitor
10+
app.kubernetes.io/part-of: bpfman-operator
11+
control-plane: controller-manager
12+
name: bpfman-controller-manager-metrics-monitor
13+
spec:
14+
endpoints:
15+
- bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
16+
path: /metrics
17+
port: https-metrics
18+
scheme: https
19+
tlsConfig:
20+
caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
21+
insecureSkipVerify: false
22+
serverName: bpfman-controller-manager-metrics-service.bpfman.svc
23+
selector:
24+
matchLabels:
25+
control-plane: controller-manager

‎bundle/manifests/bpfman-controller-manager-metrics-service_v1_service.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
apiVersion: v1
22
kind: Service
33
metadata:
4+
annotations:
5+
service.beta.openshift.io/serving-cert-secret-name: controller-manager-metrics-tls
46
creationTimestamp: null
57
labels:
6-
app.kubernetes.io/component: kube-rbac-proxy
8+
app.kubernetes.io/component: metrics
79
app.kubernetes.io/created-by: bpfman-operator
810
app.kubernetes.io/instance: controller-manager-metrics-service
911
app.kubernetes.io/managed-by: kustomize
@@ -13,10 +15,10 @@ metadata:
1315
name: bpfman-controller-manager-metrics-service
1416
spec:
1517
ports:
16-
- name: https
18+
- name: https-metrics
1719
port: 8443
1820
protocol: TCP
19-
targetPort: https
21+
targetPort: https-metrics
2022
selector:
2123
control-plane: controller-manager
2224
status:

‎bundle/manifests/bpfman-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ kind: ClusterRole
33
metadata:
44
creationTimestamp: null
55
labels:
6-
app.kubernetes.io/component: kube-rbac-proxy
6+
app.kubernetes.io/component: metrics
77
app.kubernetes.io/created-by: bpfman-operator
88
app.kubernetes.io/instance: metrics-reader
99
app.kubernetes.io/managed-by: kustomize

‎bundle/manifests/bpfman-operator.clusterserviceversion.yaml‎

Lines changed: 17 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -994,7 +994,7 @@ metadata:
994994
capabilities: Basic Install
995995
categories: OpenShift Optional
996996
containerImage: quay.io/bpfman/bpfman-operator:latest
997-
createdAt: "2025-04-30T21:37:41Z"
997+
createdAt: "2025-05-01T12:26:00Z"
998998
description: The bpfman Operator is designed to manage eBPF programs for applications.
999999
features.operators.openshift.io/cnf: "false"
10001000
features.operators.openshift.io/cni: "false"
@@ -1507,18 +1507,6 @@ spec:
15071507
- get
15081508
- list
15091509
- watch
1510-
- apiGroups:
1511-
- authentication.k8s.io
1512-
resources:
1513-
- tokenreviews
1514-
verbs:
1515-
- create
1516-
- apiGroups:
1517-
- authorization.k8s.io
1518-
resources:
1519-
- subjectaccessreviews
1520-
verbs:
1521-
- create
15221510
serviceAccountName: bpfman-operator
15231511
deployments:
15241512
- label:
@@ -1540,6 +1528,7 @@ spec:
15401528
metadata:
15411529
annotations:
15421530
kubectl.kubernetes.io/default-container: manager
1531+
service.beta.openshift.io/serving-cert-secret-name: controller-manager-metrics-tls
15431532
labels:
15441533
control-plane: controller-manager
15451534
spec:
@@ -1560,33 +1549,11 @@ spec:
15601549
values:
15611550
- linux
15621551
containers:
1563-
- args:
1564-
- --secure-listen-address=0.0.0.0:8443
1565-
- --upstream=http://127.0.0.1:8174/
1566-
- --logtostderr=true
1567-
- --v=0
1568-
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.0
1569-
name: kube-rbac-proxy
1570-
ports:
1571-
- containerPort: 8443
1572-
name: https
1573-
protocol: TCP
1574-
resources:
1575-
limits:
1576-
cpu: 500m
1577-
memory: 128Mi
1578-
requests:
1579-
cpu: 5m
1580-
memory: 64Mi
1581-
securityContext:
1582-
allowPrivilegeEscalation: false
1583-
capabilities:
1584-
drop:
1585-
- ALL
15861552
- args:
15871553
- --health-probe-bind-address=:8175
1588-
- --metrics-bind-address=127.0.0.1:8174
1554+
- --metrics-bind-address=:8443
15891555
- --leader-elect
1556+
- --cert-dir=/tmp/k8s-webhook-server/serving-certs
15901557
command:
15911558
- /bpfman-operator
15921559
env:
@@ -1601,6 +1568,10 @@ spec:
16011568
initialDelaySeconds: 15
16021569
periodSeconds: 20
16031570
name: bpfman-operator
1571+
ports:
1572+
- containerPort: 8443
1573+
name: https-metrics
1574+
protocol: TCP
16041575
readinessProbe:
16051576
httpGet:
16061577
path: /readyz
@@ -1612,17 +1583,25 @@ spec:
16121583
cpu: 500m
16131584
memory: 128Mi
16141585
requests:
1615-
cpu: 10m
1586+
cpu: 5m
16161587
memory: 64Mi
16171588
securityContext:
16181589
allowPrivilegeEscalation: false
16191590
capabilities:
16201591
drop:
16211592
- ALL
1593+
volumeMounts:
1594+
- mountPath: /tmp/k8s-webhook-server/serving-certs
1595+
name: controller-manager-metrics-tls
1596+
readOnly: true
16221597
securityContext:
16231598
runAsNonRoot: true
16241599
serviceAccountName: bpfman-operator
16251600
terminationGracePeriodSeconds: 10
1601+
volumes:
1602+
- name: controller-manager-metrics-tls
1603+
secret:
1604+
secretName: controller-manager-metrics-tls
16261605
permissions:
16271606
- rules:
16281607
- apiGroups:

‎bundle/manifests/bpfman-prometheus-k8s_rbac.authorization.k8s.io_v1_role.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
creationTimestamp: null
5+
name: bpfman-prometheus-k8s
6+
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- pods
11+
- services
12+
- endpoints
13+
- configmaps
14+
- secrets
15+
verbs:
16+
- get
17+
- list
18+
- watch

‎bundle/manifests/bpfman-prometheus-k8s_rbac.authorization.k8s.io_v1_rolebinding.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
creationTimestamp: null
5+
name: bpfman-prometheus-k8s
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: Role
9+
name: bpfman-prometheus-k8s
10+
subjects:
11+
- kind: ServiceAccount
12+
name: prometheus-k8s
13+
namespace: openshift-monitoring

0 commit comments

Comments
 (0)