Skip to content

Commit 83a7738

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request kubernetes-sigs#4245 from camilamacedo86/fix-info-comment-main.go
🐛 Fix misleading metrics configuration comments in cmd/main.go for metrics certs
2 parents 7dc2f08 + cd15f73 commit 83a7738

File tree

8 files changed

+54
-53
lines changed
  • docs/book/src
    • cronjob-tutorial/testdata/project/cmd
    • getting-started/testdata/project/cmd
    • multiversion-tutorial/testdata/project/cmd
    • reference
  • pkg/plugins/golang/v4/scaffolds/internal/templates/cmd
  • testdata

8 files changed

+54
-53
lines changed

‎docs/book/src/cronjob-tutorial/testdata/project/cmd/main.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -123,13 +123,7 @@ func main() {
123123
metricsServerOptions := metricsserver.Options{
124124
BindAddress: metricsAddr,
125125
SecureServing: secureMetrics,
126-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
127-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
128-
// production environments as self-signed certificates do not offer the same level of trust and security
129-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
130-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
131-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
132-
TLSOpts: tlsOpts,
126+
TLSOpts: tlsOpts,
133127
}
134128

135129
if secureMetrics {
@@ -138,6 +132,10 @@ func main() {
138132
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
139133
// https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization
140134
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
135+
136+
// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
137+
// generate self-signed certificates for the metrics server. While convenient for development and testing,
138+
// this setup is not recommended for production.
141139
}
142140

143141
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{

‎docs/book/src/getting-started/testdata/project/cmd/main.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -103,13 +103,7 @@ func main() {
103103
metricsServerOptions := metricsserver.Options{
104104
BindAddress: metricsAddr,
105105
SecureServing: secureMetrics,
106-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
107-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
108-
// production environments as self-signed certificates do not offer the same level of trust and security
109-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
110-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
111-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
112-
TLSOpts: tlsOpts,
106+
TLSOpts: tlsOpts,
113107
}
114108

115109
if secureMetrics {
@@ -118,6 +112,10 @@ func main() {
118112
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
119113
// https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization
120114
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
115+
116+
// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
117+
// generate self-signed certificates for the metrics server. While convenient for development and testing,
118+
// this setup is not recommended for production.
121119
}
122120

123121
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{

‎docs/book/src/multiversion-tutorial/testdata/project/cmd/main.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -122,13 +122,7 @@ func main() {
122122
metricsServerOptions := metricsserver.Options{
123123
BindAddress: metricsAddr,
124124
SecureServing: secureMetrics,
125-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
126-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
127-
// production environments as self-signed certificates do not offer the same level of trust and security
128-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
129-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
130-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
131-
TLSOpts: tlsOpts,
125+
TLSOpts: tlsOpts,
132126
}
133127

134128
if secureMetrics {
@@ -137,6 +131,10 @@ func main() {
137131
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
138132
// https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization
139133
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
134+
135+
// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
136+
// generate self-signed certificates for the metrics server. While convenient for development and testing,
137+
// this setup is not recommended for production.
140138
}
141139

142140
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{

‎docs/book/src/reference/metrics.md‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -136,13 +136,28 @@ spec:
136136
<aside class="warning">
137137
<h1>Changes Recommended for Production</h1>
138138

139-
The default scaffold in `cmd/main.go` uses a **controller-runtime feature**
140-
to generate a certificate for securing the metrics server. While convenient
141-
for development and testing, this setup is **not recommended for production**.
139+
The default scaffold in `cmd/main.go` uses a **controller-runtime feature** to
140+
automatically generate a self-signed certificate to secure the metrics server.
141+
While this is convenient for development and testing, it is not recommended
142+
for production.
143+
144+
You can mount a certificate into the Manager Deployment and configure the
145+
metrics server to use it, as shown below:
146+
147+
```go
148+
if secureMetrics {
149+
...
150+
151+
// Specify the path where the certificate is mounted
152+
metricsServerOptions.CertDir = "/tmp/k8s-metrics-server/serving-certs"
153+
metricsServerOptions.CertName = "tls.crt"
154+
metricsServerOptions.KeyName = "tls.key"
155+
}
156+
```
142157

143158
Additionally, review the configuration file at `config/prometheus/monitor.yaml`
144-
to ensure secure integration with Prometheus. If `insecureSkipVerify: true` is
145-
enabled, certificate verification is turned off. **This is not recommended for production**
159+
to ensure secure integration with Prometheus. **If `insecureSkipVerify: true` is
160+
enabled, certificate verification is turned off. This is not recommended for production**
146161
as it exposes the system to man-in-the-middle attacks, potentially allowing
147162
unauthorized access to metrics data.
148163

‎pkg/plugins/golang/v4/scaffolds/internal/templates/cmd/main.go‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -305,12 +305,6 @@ func main() {
305305
metricsServerOptions := metricsserver.Options{
306306
BindAddress: metricsAddr,
307307
SecureServing: secureMetrics,
308-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
309-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
310-
// production environments as self-signed certificates do not offer the same level of trust and security
311-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
312-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
313-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
314308
TLSOpts: tlsOpts,
315309
}
316310
@@ -320,6 +314,10 @@ func main() {
320314
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
321315
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@{{ .ControllerRuntimeVersion }}/pkg/metrics/filters#WithAuthenticationAndAuthorization
322316
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
317+
318+
// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
319+
// generate self-signed certificates for the metrics server. While convenient for development and testing,
320+
// this setup is not recommended for production.
323321
}
324322
325323
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{

‎testdata/project-v4-multigroup/cmd/main.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -139,13 +139,7 @@ func main() {
139139
metricsServerOptions := metricsserver.Options{
140140
BindAddress: metricsAddr,
141141
SecureServing: secureMetrics,
142-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
143-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
144-
// production environments as self-signed certificates do not offer the same level of trust and security
145-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
146-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
147-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
148-
TLSOpts: tlsOpts,
142+
TLSOpts: tlsOpts,
149143
}
150144

151145
if secureMetrics {
@@ -154,6 +148,10 @@ func main() {
154148
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
155149
// https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization
156150
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
151+
152+
// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
153+
// generate self-signed certificates for the metrics server. While convenient for development and testing,
154+
// this setup is not recommended for production.
157155
}
158156

159157
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{

‎testdata/project-v4-with-plugins/cmd/main.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -104,13 +104,7 @@ func main() {
104104
metricsServerOptions := metricsserver.Options{
105105
BindAddress: metricsAddr,
106106
SecureServing: secureMetrics,
107-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
108-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
109-
// production environments as self-signed certificates do not offer the same level of trust and security
110-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
111-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
112-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
113-
TLSOpts: tlsOpts,
107+
TLSOpts: tlsOpts,
114108
}
115109

116110
if secureMetrics {
@@ -119,6 +113,10 @@ func main() {
119113
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
120114
// https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization
121115
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
116+
117+
// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
118+
// generate self-signed certificates for the metrics server. While convenient for development and testing,
119+
// this setup is not recommended for production.
122120
}
123121

124122
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{

‎testdata/project-v4/cmd/main.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -109,13 +109,7 @@ func main() {
109109
metricsServerOptions := metricsserver.Options{
110110
BindAddress: metricsAddr,
111111
SecureServing: secureMetrics,
112-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
113-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
114-
// production environments as self-signed certificates do not offer the same level of trust and security
115-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
116-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
117-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
118-
TLSOpts: tlsOpts,
112+
TLSOpts: tlsOpts,
119113
}
120114

121115
if secureMetrics {
@@ -124,6 +118,10 @@ func main() {
124118
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
125119
// https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization
126120
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
121+
122+
// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
123+
// generate self-signed certificates for the metrics server. While convenient for development and testing,
124+
// this setup is not recommended for production.
127125
}
128126

129127
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{

0 commit comments

Comments
 (0)