feat(operator): update metrics authentication to remove dependency on kube-rbac-proxy (#20853)

Author: btaani

operator/api/config/v1/projectconfig_types.go

@@ -173,6 +173,11 @@ type ControllerMetrics struct {
 	// It can be set to "0" to disable the metrics serving.
 	// +optional
 	BindAddress string `json:"bindAddress,omitempty"`
+
+	// Secure is the flag used to enable/disable TLS authentication to
+	// access the metrics endpoint
+	// +optional
+	Secure bool `json:"secure,omitempty"`
 }
 
 // ControllerHealth defines the health configs.

operator/bundle/community-openshift/manifests/loki-operator-controller-manager-metrics-service_v1_service.yaml

@@ -14,10 +14,10 @@ metadata:
   name: loki-operator-controller-manager-metrics-service
 spec:
   ports:
-  - name: https
+  - name: metrics
     port: 8443
     protocol: TCP
-    targetPort: https
+    targetPort: metrics
   selector:
     app.kubernetes.io/managed-by: operator-lifecycle-manager
     app.kubernetes.io/name: loki-operator

operator/bundle/community-openshift/manifests/loki-operator-manager-config_v1_configmap.yaml

@@ -6,7 +6,8 @@ data:
     health:
       healthProbeBindAddress: :8081
     metrics:
-      bindAddress: 127.0.0.1:8080
+      bindAddress: :8443
+      secure: true
     webhook:
       port: 9443
     leaderElection:

operator/bundle/community-openshift/manifests/loki-operator-metrics-monitor_monitoring.coreos.com_v1_servicemonitor.yaml

@@ -20,7 +20,7 @@ spec:
     path: /metrics
     scheme: https
     scrapeTimeout: 10s
-    targetPort: 8443
+    targetPort: metrics
     tlsConfig:
       ca:
         secret:

operator/bundle/community-openshift/manifests/loki-operator.clusterserviceversion.yaml

@@ -152,7 +152,7 @@ metadata:
     categories: OpenShift Optional, Logging & Tracing
     certified: "false"
     containerImage: docker.io/grafana/loki-operator:0.9.0
-    createdAt: "2026-02-24T17:37:32Z"
+    createdAt: "2026-02-25T18:26:49Z"
     description: The Community Loki Operator provides Kubernetes native deployment
       and management of Loki and related logging components.
     features.operators.openshift.io/disconnected: "true"
@@ -1982,7 +1982,7 @@ spec:
                 - containerPort: 9443
                   name: webhook-server
                   protocol: TCP
-                - containerPort: 8080
+                - containerPort: 8443
                   name: metrics
                 readinessProbe:
                   httpGet:
@@ -2003,32 +2003,9 @@ spec:
                 - mountPath: /controller_manager_config.yaml
                   name: manager-config
                   subPath: controller_manager_config.yaml
-              - args:
-                - --secure-listen-address=0.0.0.0:8443
-                - --upstream=http://127.0.0.1:8080/
-                - --logtostderr=true
-                - --tls-cert-file=/var/run/secrets/serving-cert/tls.crt
-                - --tls-private-key-file=/var/run/secrets/serving-cert/tls.key
-                - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA256
-                - --tls-min-version=VersionTLS12
-                - --v=0
-                image: quay.io/openshift/origin-kube-rbac-proxy:latest
-                name: kube-rbac-proxy
-                ports:
-                - containerPort: 8443
-                  name: https
-                resources:
-                  requests:
-                    cpu: 200m
-                    memory: 256Mi
-                securityContext:
-                  allowPrivilegeEscalation: false
-                  capabilities:
-                    drop:
-                    - ALL
-                volumeMounts:
-                - mountPath: /var/run/secrets/serving-cert
+                - mountPath: /tmp/k8s-metrics-server/serving-certs
                   name: loki-operator-metrics-cert
+                  readOnly: true
               nodeSelector:
                 kubernetes.io/os: linux
               securityContext:

operator/bundle/community/manifests/loki-operator-controller-manager-metrics-service_v1_service.yaml

@@ -12,10 +12,10 @@ metadata:
   name: loki-operator-controller-manager-metrics-service
 spec:
   ports:
-  - name: https
+  - name: metrics
     port: 8443
     protocol: TCP
-    targetPort: https
+    targetPort: metrics
   selector:
     app.kubernetes.io/managed-by: operator-lifecycle-manager
     app.kubernetes.io/name: loki-operator

operator/bundle/community/manifests/loki-operator-manager-config_v1_configmap.yaml

@@ -6,7 +6,8 @@ data:
     health:
       healthProbeBindAddress: :8081
     metrics:
-      bindAddress: 127.0.0.1:8080
+      bindAddress: :8080
+      secure: false
     webhook:
       port: 9443
     leaderElection:

operator/bundle/community/manifests/loki-operator.clusterserviceversion.yaml

@@ -152,7 +152,7 @@ metadata:
     categories: OpenShift Optional, Logging & Tracing
     certified: "false"
     containerImage: docker.io/grafana/loki-operator:0.9.0
-    createdAt: "2026-02-24T17:37:30Z"
+    createdAt: "2026-02-25T18:26:47Z"
     description: The Community Loki Operator provides Kubernetes native deployment
       and management of Loki and related logging components.
     operators.operatorframework.io/builder: operator-sdk-unknown
@@ -1959,11 +1959,11 @@ spec:
                   periodSeconds: 20
                 name: manager
                 ports:
+                - containerPort: 8080
+                  name: metrics
                 - containerPort: 9443
                   name: webhook-server
                   protocol: TCP
-                - containerPort: 8080
-                  name: metrics
                 readinessProbe:
                   httpGet:
                     path: /readyz
@@ -1981,29 +1981,8 @@ spec:
                 - mountPath: /controller_manager_config.yaml
                   name: manager-config
                   subPath: controller_manager_config.yaml
-              - args:
-                - --secure-listen-address=0.0.0.0:8443
-                - --upstream=http://127.0.0.1:8080/
-                - --logtostderr=true
-                - --v=0
-                image: quay.io/brancz/kube-rbac-proxy:v0.18.1
-                name: kube-rbac-proxy
-                ports:
-                - containerPort: 8443
-                  name: https
-                resources:
-                  requests:
-                    cpu: 200m
-                    memory: 256Mi
-                securityContext:
-                  allowPrivilegeEscalation: false
-                  capabilities:
-                    drop:
-                    - ALL
               nodeSelector:
                 kubernetes.io/os: linux
-              securityContext:
-                runAsNonRoot: true
               serviceAccountName: loki-operator-controller-manager
               terminationGracePeriodSeconds: 10
               volumes:

operator/bundle/openshift/manifests/loki-operator-controller-manager-metrics-service_v1_service.yaml

@@ -14,10 +14,10 @@ metadata:
   name: loki-operator-controller-manager-metrics-service
 spec:
   ports:
-  - name: https
+  - name: metrics
     port: 8443
     protocol: TCP
-    targetPort: https
+    targetPort: metrics
   selector:
     app.kubernetes.io/managed-by: operator-lifecycle-manager
     app.kubernetes.io/name: loki-operator

operator/bundle/openshift/manifests/loki-operator-manager-config_v1_configmap.yaml

@@ -6,9 +6,8 @@ data:
     health:
       healthProbeBindAddress: :8081
     metrics:
-      # Bind only on this host to allow accessing metrics
-      # only via the kube-rbac-proxy sidecar.
-      bindAddress: 127.0.0.1:8080
+      bindAddress: :8443
+      secure: true
     webhook:
       port: 9443
     leaderElection: