Skip to content

Commit 3da5ce7

Browse files
camilamacedo86camilamacedo86
committed
Add Patch to give optional option to enable ServiceMonitor to use cert-manager-managed serving-cert with TLS verification
Adds a patch to configure ServiceMonitor with `insecureSkipVerify: false` to ensure TLS verification using cert-manager certificates. Updates documentation and corrects misaligned comments.
1 parent f7a02ad commit 3da5ce7

File tree

32 files changed

+419
-157
lines changed

32 files changed

+419
-157
lines changed

‎.github/workflows/test-e2e-samples.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141
run: |
4242
KUSTOMIZATION_FILE_PATH="testdata/project-v4/config/default/kustomization.yaml"
4343
sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
44-
sed -i '50,177s/^#//' $KUSTOMIZATION_FILE_PATH
44+
sed -i '57,184s/^#//' $KUSTOMIZATION_FILE_PATH
4545
cd testdata/project-v4/
4646
go mod tidy
4747
@@ -82,8 +82,8 @@ jobs:
8282
sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
8383
# Uncomment only ValidatingWebhookConfiguration
8484
# from cert-manager replaces
85-
sed -i '50,80s/^#//' $KUSTOMIZATION_FILE_PATH
86-
sed -i '144,177s/^#//' $KUSTOMIZATION_FILE_PATH
85+
sed -i '57,87s/^#//' $KUSTOMIZATION_FILE_PATH
86+
sed -i '151,184s/^#//' $KUSTOMIZATION_FILE_PATH
8787
cd testdata/project-v4-with-plugins/
8888
go mod tidy
8989
@@ -122,7 +122,7 @@ jobs:
122122
run: |
123123
KUSTOMIZATION_FILE_PATH="testdata/project-v4-multigroup/config/default/kustomization.yaml"
124124
sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
125-
sed -i '50,177s/^#//' $KUSTOMIZATION_FILE_PATH
125+
sed -i '57,184s/^#//' $KUSTOMIZATION_FILE_PATH
126126
cd testdata/project-v4-multigroup
127127
go mod tidy
128128

‎docs/book/src/cronjob-tutorial/testdata/project/cmd/main.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -123,16 +123,16 @@ func main() {
123123
metricsServerOptions := metricsserver.Options{
124124
BindAddress: metricsAddr,
125125
SecureServing: secureMetrics,
126-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
127-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
128-
// production environments as self-signed certificates do not offer the same level of trust and security
129-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
130-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
131-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
132-
TLSOpts: tlsOpts,
126+
TLSOpts: tlsOpts,
133127
}
134128

135129
if secureMetrics {
130+
// TODO(user): If cert-manager is enabled in config/default/kustomization.yaml,
131+
// you can uncomment the following lines to use the certificate managed by cert-manager.
132+
// metricsServerOptions.CertDir = "/var/run/secrets/kubernetes.io/certs"
133+
// metricsServerOptions.CertName = "tls.crt"
134+
// metricsServerOptions.KeyName = "tls.key"
135+
136136
// FilterProvider is used to protect the metrics endpoint with authn/authz.
137137
// These configurations ensure that only authorized users and service accounts
138138
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:

‎docs/book/src/cronjob-tutorial/testdata/project/config/default/kustomization.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,16 @@ patches:
4141
target:
4242
kind: Deployment
4343

44+
# [PROMETHEUS WITH CERTMANAGER] The following patch configures the ServiceMonitor in ../prometheus
45+
# to securely reference certificates created and managed by cert-manager.
46+
# Additionally, uncomment the [WEBHOOK] patch below to mount the "serving-cert"
47+
# secret in the Manager Deployment.
48+
#- path: ../prometheus/monitor_tls_patch.yaml
49+
# target:
50+
# kind: ServiceMonitor
51+
4452
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
45-
# crd/kustomization.yaml
53+
# crd/kustomization.yaml.
4654
- path: manager_webhook_patch.yaml
4755

4856
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.

‎docs/book/src/cronjob-tutorial/testdata/project/config/prometheus/monitor.yaml‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,10 @@ spec:
1616
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
1717
tlsConfig:
1818
# TODO(user): The option insecureSkipVerify: true is not recommended for production since it disables
19-
# certificate verification. This poses a significant security risk by making the system vulnerable to
20-
# man-in-the-middle attacks, where an attacker could intercept and manipulate the communication between
21-
# Prometheus and the monitored services. This could lead to unauthorized access to sensitive metrics data,
22-
# compromising the integrity and confidentiality of the information.
23-
# Please use the following options for secure configurations:
24-
# caFile: /etc/metrics-certs/ca.crt
25-
# certFile: /etc/metrics-certs/tls.crt
26-
# keyFile: /etc/metrics-certs/tls.key
19+
# certificate verification, exposing the system to potential man-in-the-middle attacks.
20+
# For production environments, it is recommended to use cert-manager for automatic TLS certificate management.
21+
# To apply this configuration, enable cert-manager and use the patch located at config/prometheus/servicemonitor_tls_patch.yaml,
22+
# which securely references the certificate from the 'serving-cert' secret.
2723
insecureSkipVerify: true
2824
selector:
2925
matchLabels:

‎docs/book/src/cronjob-tutorial/testdata/project/config/prometheus/monitor_tls_patch.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Patch for Prometheus ServiceMonitor to enable secure TLS configuration
2+
# using certificates managed by cert-manager
3+
apiVersion: monitoring.coreos.com/v1
4+
kind: ServiceMonitor
5+
metadata:
6+
name: controller-manager-metrics-monitor
7+
namespace: system
8+
spec:
9+
endpoints:
10+
- tlsConfig:
11+
insecureSkipVerify: false
12+
ca:
13+
secret:
14+
name: serving-cert
15+
key: ca.crt
16+
cert:
17+
secret:
18+
name: serving-cert
19+
key: tls.crt
20+
keySecret:
21+
name: serving-cert
22+
key: tls.key

‎docs/book/src/getting-started/testdata/project/cmd/main.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -103,16 +103,16 @@ func main() {
103103
metricsServerOptions := metricsserver.Options{
104104
BindAddress: metricsAddr,
105105
SecureServing: secureMetrics,
106-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
107-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
108-
// production environments as self-signed certificates do not offer the same level of trust and security
109-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
110-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
111-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
112-
TLSOpts: tlsOpts,
106+
TLSOpts: tlsOpts,
113107
}
114108

115109
if secureMetrics {
110+
// TODO(user): If cert-manager is enabled in config/default/kustomization.yaml,
111+
// you can uncomment the following lines to use the certificate managed by cert-manager.
112+
// metricsServerOptions.CertDir = "/var/run/secrets/kubernetes.io/certs"
113+
// metricsServerOptions.CertName = "tls.crt"
114+
// metricsServerOptions.KeyName = "tls.key"
115+
116116
// FilterProvider is used to protect the metrics endpoint with authn/authz.
117117
// These configurations ensure that only authorized users and service accounts
118118
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:

‎docs/book/src/getting-started/testdata/project/config/default/kustomization.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,16 @@ patches:
4141
target:
4242
kind: Deployment
4343

44+
# [PROMETHEUS WITH CERTMANAGER] The following patch configures the ServiceMonitor in ../prometheus
45+
# to securely reference certificates created and managed by cert-manager.
46+
# Additionally, uncomment the [WEBHOOK] patch below to mount the "serving-cert"
47+
# secret in the Manager Deployment.
48+
#- path: ../prometheus/monitor_tls_patch.yaml
49+
# target:
50+
# kind: ServiceMonitor
51+
4452
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
45-
# crd/kustomization.yaml
53+
# crd/kustomization.yaml.
4654
#- path: manager_webhook_patch.yaml
4755

4856
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.

‎docs/book/src/getting-started/testdata/project/config/prometheus/monitor.yaml‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,10 @@ spec:
1616
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
1717
tlsConfig:
1818
# TODO(user): The option insecureSkipVerify: true is not recommended for production since it disables
19-
# certificate verification. This poses a significant security risk by making the system vulnerable to
20-
# man-in-the-middle attacks, where an attacker could intercept and manipulate the communication between
21-
# Prometheus and the monitored services. This could lead to unauthorized access to sensitive metrics data,
22-
# compromising the integrity and confidentiality of the information.
23-
# Please use the following options for secure configurations:
24-
# caFile: /etc/metrics-certs/ca.crt
25-
# certFile: /etc/metrics-certs/tls.crt
26-
# keyFile: /etc/metrics-certs/tls.key
19+
# certificate verification, exposing the system to potential man-in-the-middle attacks.
20+
# For production environments, it is recommended to use cert-manager for automatic TLS certificate management.
21+
# To apply this configuration, enable cert-manager and use the patch located at config/prometheus/servicemonitor_tls_patch.yaml,
22+
# which securely references the certificate from the 'serving-cert' secret.
2723
insecureSkipVerify: true
2824
selector:
2925
matchLabels:

‎docs/book/src/getting-started/testdata/project/config/prometheus/monitor_tls_patch.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Patch for Prometheus ServiceMonitor to enable secure TLS configuration
2+
# using certificates managed by cert-manager
3+
apiVersion: monitoring.coreos.com/v1
4+
kind: ServiceMonitor
5+
metadata:
6+
name: controller-manager-metrics-monitor
7+
namespace: system
8+
spec:
9+
endpoints:
10+
- tlsConfig:
11+
insecureSkipVerify: false
12+
ca:
13+
secret:
14+
name: serving-cert
15+
key: ca.crt
16+
cert:
17+
secret:
18+
name: serving-cert
19+
key: tls.crt
20+
keySecret:
21+
name: serving-cert
22+
key: tls.key

‎docs/book/src/multiversion-tutorial/testdata/project/cmd/main.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -122,16 +122,16 @@ func main() {
122122
metricsServerOptions := metricsserver.Options{
123123
BindAddress: metricsAddr,
124124
SecureServing: secureMetrics,
125-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
126-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
127-
// production environments as self-signed certificates do not offer the same level of trust and security
128-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
129-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
130-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
131-
TLSOpts: tlsOpts,
125+
TLSOpts: tlsOpts,
132126
}
133127

134128
if secureMetrics {
129+
// TODO(user): If cert-manager is enabled in config/default/kustomization.yaml,
130+
// you can uncomment the following lines to use the certificate managed by cert-manager.
131+
// metricsServerOptions.CertDir = "/var/run/secrets/kubernetes.io/certs"
132+
// metricsServerOptions.CertName = "tls.crt"
133+
// metricsServerOptions.KeyName = "tls.key"
134+
135135
// FilterProvider is used to protect the metrics endpoint with authn/authz.
136136
// These configurations ensure that only authorized users and service accounts
137137
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:

0 commit comments

Comments
 (0)