@@ -20,16 +20,13 @@ import (
2020 "crypto/tls"
2121 "errors"
2222 "flag"
23+ "github.com/peterbourgon/ff"
2324 "os"
24- "path/filepath "
25+ "sigs.k8s.io/controller-runtime/pkg/log/zap "
2526
26- "github.com/go-logr/zapr"
2727 "github.com/pdok/mapserver-operator/internal/controller/mapfilegenerator"
2828 smoothoperator "github.com/pdok/smooth-operator/api/v1"
29- "github.com/pdok/smooth-operator/pkg/integrations/logging"
3029 traefikiov1alpha1 "github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1"
31- "go.uber.org/zap/zapcore"
32-
3330 // Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
3431 // to ensure that exec-entrypoint and run can make use of them.
3532 _ "k8s.io/client-go/plugin/pkg/client/auth"
@@ -38,9 +35,7 @@ import (
3835 utilruntime "k8s.io/apimachinery/pkg/util/runtime"
3936 clientgoscheme "k8s.io/client-go/kubernetes/scheme"
4037 ctrl "sigs.k8s.io/controller-runtime"
41- "sigs.k8s.io/controller-runtime/pkg/certwatcher"
4238 "sigs.k8s.io/controller-runtime/pkg/healthz"
43- "sigs.k8s.io/controller-runtime/pkg/metrics/filters"
4439 metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
4540 "sigs.k8s.io/controller-runtime/pkg/webhook"
4641
@@ -81,8 +76,7 @@ func init() {
8176//nolint:gocyclo
8277func main () {
8378 var metricsAddr string
84- var metricsCertPath , metricsCertName , metricsCertKey string
85- var webhookCertPath , webhookCertName , webhookCertKey string
79+ var certDir string
8680 var enableLeaderElection bool
8781 var probeAddr string
8882 var secureMetrics bool
@@ -93,21 +87,15 @@ func main() {
9387 var multitoolImage , mapfileGeneratorImage , mapserverImage , capabilitiesGeneratorImage , featureinfoGeneratorImage , ogcWebserviceProxyImage , apacheExporterImage string
9488 var slackWebhookURL string
9589 var logLevel int
96- flag .StringVar (& metricsAddr , "metrics-bind-address" , "0 " , "The address the metrics endpoint binds to. " +
90+ flag .StringVar (& metricsAddr , "metrics-bind-address" , ":8080 " , "The address the metrics endpoint binds to. " +
9791 "Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service." )
9892 flag .StringVar (& probeAddr , "health-probe-bind-address" , ":8081" , "The address the probe endpoint binds to." )
9993 flag .BoolVar (& enableLeaderElection , "leader-elect" , false ,
10094 "Enable leader election for controller manager. " +
10195 "Enabling this will ensure there is only one active controller manager." )
10296 flag .BoolVar (& secureMetrics , "metrics-secure" , true ,
10397 "If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead." )
104- flag .StringVar (& webhookCertPath , "webhook-cert-path" , "" , "The directory that contains the webhook certificate." )
105- flag .StringVar (& webhookCertName , "webhook-cert-name" , "tls.crt" , "The name of the webhook certificate file." )
106- flag .StringVar (& webhookCertKey , "webhook-cert-key" , "tls.key" , "The name of the webhook key file." )
107- flag .StringVar (& metricsCertPath , "metrics-cert-path" , "" ,
108- "The directory that contains the metrics server certificate." )
109- flag .StringVar (& metricsCertName , "metrics-cert-name" , "tls.crt" , "The name of the metrics server certificate file." )
110- flag .StringVar (& metricsCertKey , "metrics-cert-key" , "tls.key" , "The name of the metrics server key file." )
98+ flag .StringVar (& certDir , "cert-dir" , "" , "CertDir contains the webhook server key and certificate. Defaults to <temp-dir>/k8s-webhook-server/serving-certs." )
11199 flag .BoolVar (& enableHTTP2 , "enable-http2" , false ,
112100 "If set, HTTP/2 will be enabled for the metrics and webhook servers" )
113101 flag .StringVar (& host , "baseurl" , "" , "The host which is used in the mapserver service." )
@@ -122,13 +110,17 @@ func main() {
122110 flag .StringVar (& slackWebhookURL , "slack-webhook-url" , "" , "The webhook url for sending slack messages. Disabled if left empty" )
123111 flag .IntVar (& logLevel , "log-level" , 0 , "The zapcore loglevel. 0 = info, 1 = warn, 2 = error" )
124112
125- flag .Parse ()
113+ opts := zap.Options {
114+ Development : true ,
115+ }
116+ opts .BindFlags (flag .CommandLine )
126117
127- //nolint:gosec
128- levelEnabler := zapcore .Level (logLevel )
129- zapLogger , _ := logging .SetupLogger ("atom-operator" , slackWebhookURL , levelEnabler )
118+ if err := ff .Parse (flag .CommandLine , os .Args [1 :], ff .WithEnvVarNoPrefix ()); err != nil {
119+ setupLog .Error (err , "unable to parse flags" )
120+ os .Exit (1 )
121+ }
130122
131- ctrl .SetLogger (zapr . NewLogger ( zapLogger ))
123+ ctrl .SetLogger (zap . New ( zap . UseFlagOptions ( & opts ) ))
132124
133125 if host == "" {
134126 setupLog .Error (errors .New ("baseURL is required" ), "A value for baseURL must be specified." )
@@ -152,83 +144,18 @@ func main() {
152144 tlsOpts = append (tlsOpts , disableHTTP2 )
153145 }
154146
155- // Create watchers for metrics and webhooks certificates
156- var metricsCertWatcher , webhookCertWatcher * certwatcher.CertWatcher
157-
158- // Initial webhook TLS options
159- webhookTLSOpts := tlsOpts
160-
161- if len (webhookCertPath ) > 0 {
162- setupLog .Info ("Initializing webhook certificate watcher using provided certificates" ,
163- "webhook-cert-path" , webhookCertPath , "webhook-cert-name" , webhookCertName , "webhook-cert-key" , webhookCertKey )
164-
165- var err error
166- webhookCertWatcher , err = certwatcher .New (
167- filepath .Join (webhookCertPath , webhookCertName ),
168- filepath .Join (webhookCertPath , webhookCertKey ),
169- )
170- if err != nil {
171- setupLog .Error (err , "Failed to initialize webhook certificate watcher" )
172- os .Exit (1 )
173- }
174-
175- webhookTLSOpts = append (webhookTLSOpts , func (config * tls.Config ) {
176- config .GetCertificate = webhookCertWatcher .GetCertificate
177- })
178- }
179-
180147 webhookServer := webhook .NewServer (webhook.Options {
181- TLSOpts : webhookTLSOpts ,
148+ CertDir : certDir ,
149+ TLSOpts : tlsOpts ,
182150 })
183151
184- // Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
185- // More info:
186- // - https://pkg.go.dev/sigs.k8s.io/[email protected] /pkg/metrics/server 187- // - https://book.kubebuilder.io/reference/metrics.html
188- metricsServerOptions := metricsserver.Options {
189- BindAddress : metricsAddr ,
190- SecureServing : secureMetrics ,
191- TLSOpts : tlsOpts ,
192- }
193-
194- if secureMetrics {
195- // FilterProvider is used to protect the metrics endpoint with authn/authz.
196- // These configurations ensure that only authorized users and service accounts
197- // can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
198- // https://pkg.go.dev/sigs.k8s.io/[email protected] /pkg/metrics/filters#WithAuthenticationAndAuthorization 199- metricsServerOptions .FilterProvider = filters .WithAuthenticationAndAuthorization
200- }
201-
202- // If the certificate is not specified, controller-runtime will automatically
203- // generate self-signed certificates for the metrics server. While convenient for development and testing,
204- // this setup is not recommended for production.
205- //
206- // TODO(user): If you enable certManager, uncomment the following lines:
207- // - [METRICS-WITH-CERTS] at config/default/kustomization.yaml to generate and use certificates
208- // managed by cert-manager for the metrics server.
209- // - [PROMETHEUS-WITH-CERTS] at config/prometheus/kustomization.yaml for TLS certification.
210- if len (metricsCertPath ) > 0 {
211- setupLog .Info ("Initializing metrics certificate watcher using provided certificates" ,
212- "metrics-cert-path" , metricsCertPath , "metrics-cert-name" , metricsCertName , "metrics-cert-key" , metricsCertKey )
213-
214- var err error
215- metricsCertWatcher , err = certwatcher .New (
216- filepath .Join (metricsCertPath , metricsCertName ),
217- filepath .Join (metricsCertPath , metricsCertKey ),
218- )
219- if err != nil {
220- setupLog .Error (err , "to initialize metrics certificate watcher" , "error" , err )
221- os .Exit (1 )
222- }
223-
224- metricsServerOptions .TLSOpts = append (metricsServerOptions .TLSOpts , func (config * tls.Config ) {
225- config .GetCertificate = metricsCertWatcher .GetCertificate
226- })
227- }
228-
229152 mgr , err := ctrl .NewManager (ctrl .GetConfigOrDie (), ctrl.Options {
230- Scheme : scheme ,
231- Metrics : metricsServerOptions ,
153+ Scheme : scheme ,
154+ Metrics : metricsserver.Options {
155+ BindAddress : metricsAddr ,
156+ SecureServing : secureMetrics ,
157+ TLSOpts : tlsOpts ,
158+ },
232159 WebhookServer : webhookServer ,
233160 HealthProbeBindAddress : probeAddr ,
234161 LeaderElection : enableLeaderElection ,
@@ -303,22 +230,6 @@ func main() {
303230 }
304231 // +kubebuilder:scaffold:builder
305232
306- if metricsCertWatcher != nil {
307- setupLog .Info ("Adding metrics certificate watcher to manager" )
308- if err := mgr .Add (metricsCertWatcher ); err != nil {
309- setupLog .Error (err , "unable to add metrics certificate watcher to manager" )
310- os .Exit (1 )
311- }
312- }
313-
314- if webhookCertWatcher != nil {
315- setupLog .Info ("Adding webhook certificate watcher to manager" )
316- if err := mgr .Add (webhookCertWatcher ); err != nil {
317- setupLog .Error (err , "unable to add webhook certificate watcher to manager" )
318- os .Exit (1 )
319- }
320- }
321-
322233 if err := mgr .AddHealthzCheck ("healthz" , healthz .Ping ); err != nil {
323234 setupLog .Error (err , "unable to set up health check" )
324235 os .Exit (1 )
0 commit comments