Skip to content

Remove kube-rbac-proxy sidecar from metrics exporter DaemonSet #1060

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zeeke wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Remove kube-rbac-proxy sidecar from metrics exporter DaemonSet #1060

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 17 additions & 31 deletions bindata/manifests/metrics-exporter/metrics-daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,11 @@ spec:
containers:
- name: metrics-exporter
args:
- --web.listen-address=127.0.0.1:{{.MetricsExporterPort}}
- --web.listen-address=[$(HOST_IP)]:{{.MetricsExporterPort}}
- --tls-cert-file=/etc/metrics/tls.crt
- --tls-private-key-file=/etc/metrics/tls.key
- --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

For better maintainability, consider defining this long list of TLS cipher suites as a constant in a Go file and passing it to the template. Hardcoding it here makes it difficult to read and manage.

For example, you could:

  1. Define a constant in pkg/consts/constants.go.
  2. Pass it to the template data in controllers/sriovoperatorconfig_controller.go.
  3. Use the variable in this template as shown in the suggestion.
- --tls-cipher-suites={{.TLSCipherSuites}}

- --authentication-and-authorization
- --path.kubecgroup=/sys/fs/cgroup
- --path.sysbuspci=/host/sys/bus/pci/devices/
- --path.sysclassnet=/host/sys/class/net/
Expand All @@ -35,14 +39,22 @@ spec:
- --collector.vfstatspriority=netlink,sysfs
image: {{.Image}}
imagePullPolicy: IfNotPresent
ports:
- containerPort: {{.MetricsExporterPort}}
name: https-metrics
env:
- name: HOST_IP
valueFrom:
fieldRef:
fieldPath: status.hostIP
resources:
requests:
memory: 100Mi
cpu: 100m
securityContext:
capabilities:
drop:
- ALL
- ALL
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
volumeMounts:
Expand All @@ -60,35 +72,9 @@ spec:
- mountPath: /host/cpu_manager_state
name: cpucheckpoint
readOnly: true
- name: kube-rbac-proxy
image: '{{.MetricsExporterKubeRbacProxyImage}}'
imagePullPolicy: IfNotPresent
args:
- --logtostderr
- --secure-listen-address=[$(HOST_IP)]:{{.MetricsExporterPort}}
- --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
- --upstream=http://127.0.0.1:{{.MetricsExporterPort}}/
- --tls-private-key-file=/etc/metrics/tls.key
- --tls-cert-file=/etc/metrics/tls.crt
ports:
- containerPort: {{.MetricsExporterPort}}
name: https-metrics
env:
- name: HOST_IP
valueFrom:
fieldRef:
fieldPath: status.hostIP
securityContext:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
resources:
requests:
cpu: 10m
memory: 20Mi
volumeMounts:
- name: metrics-certs
mountPath: /etc/metrics
readOnly: true
- name: metrics-certs
mountPath: /etc/metrics
readOnly: true
nodeSelector:
{{- range $key, $value := .NodeSelectorField }}
{{ $key }}: "{{ $value }}"
Expand Down
2 changes: 0 additions & 2 deletions controllers/sriovoperatorconfig_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,8 +254,6 @@ func (r *SriovOperatorConfigReconciler) syncMetricsExporter(ctx context.Context,
data.Data["ImagePullSecrets"] = GetImagePullSecrets()
data.Data["MetricsExporterSecretName"] = os.Getenv("METRICS_EXPORTER_SECRET_NAME")
data.Data["MetricsExporterPort"] = os.Getenv("METRICS_EXPORTER_PORT")
data.Data["MetricsExporterKubeRbacProxyImage"] = os.Getenv("METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE")

data.Data["IsOpenshift"] = r.Orchestrator.ClusterType() == consts.ClusterTypeOpenshift

data.Data["IsPrometheusOperatorInstalled"] = strings.ToLower(os.Getenv("METRICS_EXPORTER_PROMETHEUS_OPERATOR_ENABLED")) == trueString
Expand Down
2 changes: 0 additions & 2 deletions controllers/suite_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,8 +150,6 @@ var _ = BeforeSuite(func() {
Expect(err).NotTo(HaveOccurred())
err = os.Setenv("METRICS_EXPORTER_PORT", "9110")
Expect(err).NotTo(HaveOccurred())
err = os.Setenv("METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE", "mock-image")
Expect(err).NotTo(HaveOccurred())
err = os.Setenv("METRICS_EXPORTER_PROMETHEUS_OPERATOR_SERVICE_ACCOUNT", "k8s-prometheus")
Expect(err).NotTo(HaveOccurred())
err = os.Setenv("METRICS_EXPORTER_PROMETHEUS_OPERATOR_NAMESPACE", "default")
Expand Down
2 changes: 0 additions & 2 deletions deploy/operator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,6 @@ spec:
value: $SRIOV_NETWORK_WEBHOOK_IMAGE
- name: METRICS_EXPORTER_IMAGE
value: $METRICS_EXPORTER_IMAGE
- name: METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE
value: $METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE
- name: METRICS_EXPORTER_PROMETHEUS_OPERATOR_ENABLED
value: "$METRICS_EXPORTER_PROMETHEUS_OPERATOR_ENABLED"
- name: METRICS_EXPORTER_PROMETHEUS_DEPLOY_RULES
Expand Down
1 change: 0 additions & 1 deletion deployment/sriov-network-operator-chart/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,6 @@ Upon chart deletion, those files are not cleaned up. For cases where this is not
| `images.resourcesInjector` | Resources Injector image |
| `images.webhook` | Operator Webhook image |
| `images.metricsExporter` | Network Metrics Exporter image |
| `images.metricsExporterKubeRbacProxy` | Kube RBAC Proxy image used for metrics exporter |

### Extra objects parameters

Expand Down
2 changes: 0 additions & 2 deletions deployment/sriov-network-operator-chart/templates/operator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,8 +85,6 @@ spec:
value: "{{ .Values.operator.metricsExporter.port }}"
- name: METRICS_EXPORTER_SECRET_NAME
value: {{ .Values.operator.metricsExporter.certificates.secretName }}
- name: METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE
value: {{ .Values.images.metricsExporterKubeRbacProxy }}
{{- if .Values.operator.externalDrainer.enabled }}
- name: USE_EXTERNAL_DRAINER
value: {{ .Values.operator.externalDrainer.enabled | quote }}
Expand Down
1 change: 0 additions & 1 deletion deployment/sriov-network-operator-chart/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,6 @@ images:
resourcesInjector: ghcr.io/k8snetworkplumbingwg/network-resources-injector
webhook: ghcr.io/k8snetworkplumbingwg/sriov-network-operator-webhook
metricsExporter: ghcr.io/k8snetworkplumbingwg/sriov-network-metrics-exporter
metricsExporterKubeRbacProxy: gcr.io/kubebuilder/kube-rbac-proxy:v0.15.0

imagePullSecrets: []
extraDeploy: []
2 changes: 0 additions & 2 deletions hack/env.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ if [ -z $SKIP_VAR_SET ]; then
export SRIOV_NETWORK_WEBHOOK_IMAGE=${SRIOV_NETWORK_WEBHOOK_IMAGE:-ghcr.io/k8snetworkplumbingwg/sriov-network-operator-webhook}
export METRICS_EXPORTER_IMAGE=${METRICS_EXPORTER_IMAGE:-ghcr.io/k8snetworkplumbingwg/sriov-network-metrics-exporter}
export SRIOV_NETWORK_OPERATOR_IMAGE=${SRIOV_NETWORK_OPERATOR_IMAGE:-ghcr.io/k8snetworkplumbingwg/sriov-network-operator}
export METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE=${METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE:-gcr.io/kubebuilder/kube-rbac-proxy:v0.15.0}
fail_msg_detect="is empty and failed to detect"
else
fail_msg_detect="is empty but SKIP_VAR_SET is set"
Expand All @@ -23,7 +22,6 @@ fi
OVS_CNI_IMAGE=${OVS_CNI_IMAGE:-}
# ensure that RDMA_CNI_IMAGE is set, empty string is a valid value
RDMA_CNI_IMAGE=${RDMA_CNI_IMAGE:-}
METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE=${METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE:-}
[ -z $SRIOV_CNI_IMAGE ] && echo "SRIOV_CNI_IMAGE $fail_msg_detect" && exit 1
[ -z $SRIOV_INFINIBAND_CNI_IMAGE ] && echo "SRIOV_INFINIBAND_CNI_IMAGE $fail_msg_detect" && exit 1
[ -z $SRIOV_DEVICE_PLUGIN_IMAGE ] && echo "SRIOV_DEVICE_PLUGIN_IMAGE $fail_msg_detect" && exit 1
Expand Down
Loading