Skip to content

Commit 30fcc26

Browse files
tmshorttmshort
committed
Remove kube-rbac-proxy from PSM
The PSM was using controller-runtime for health/metrics and using kube-rbac-proxy for TLS support. This removes the kube-rbac-proxy and implements the health/metrics servers using the same code that the OLM and Catalog controllers use. This also adds TLS configuration flags identical to those used for OLM and Catalog operators. This will make updating the PSM for OpenShift TLS Profiles significantly easier, as code can be shared between all the operators. Signed-off-by: Todd Short <todd.short@me.com> Assisted-by: Claude code
1 parent 4cc2eca commit 30fcc26

File tree

7 files changed

+130
-161
lines changed

7 files changed

+130
-161
lines changed

‎cmd/package-server-manager/main.go‎

Lines changed: 37 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,11 @@ import (
44
"fmt"
55
"os"
66

7+
"github.com/sirupsen/logrus"
78
"github.com/spf13/cobra"
89

910
olmv1alpha1 "github.com/operator-framework/api/pkg/operators/v1alpha1"
11+
"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/server"
1012

1113
"k8s.io/apimachinery/pkg/fields"
1214
_ "k8s.io/client-go/plugin/pkg/client/auth"
@@ -17,7 +19,6 @@ import (
1719
ctrl "sigs.k8s.io/controller-runtime"
1820
"sigs.k8s.io/controller-runtime/pkg/cache"
1921
"sigs.k8s.io/controller-runtime/pkg/client"
20-
"sigs.k8s.io/controller-runtime/pkg/healthz"
2122
"sigs.k8s.io/controller-runtime/pkg/log/zap"
2223
"sigs.k8s.io/controller-runtime/pkg/manager"
2324
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
@@ -30,8 +31,8 @@ import (
3031
const (
3132
defaultName = "packageserver"
3233
defaultNamespace = "openshift-operator-lifecycle-manager"
33-
defaultMetricsPort = "0"
34-
defaultHealthCheckPort = ":8080"
34+
defaultMetricsPort = "0" // Disable controller-runtime metrics (using pkg/lib/server instead)
35+
defaultHealthCheckPort = "" // Disable controller-runtime health (using pkg/lib/server instead)
3536
defaultPprofPort = ":6060"
3637
defaultInterval = ""
3738
leaderElectionConfigmapName = "packageserver-controller-lock"
@@ -75,11 +76,43 @@ func run(cmd *cobra.Command, args []string) error {
7576
if err != nil {
7677
return err
7778
}
79+
tlsCertPath, err := cmd.Flags().GetString("tls-cert")
80+
if err != nil {
81+
return err
82+
}
83+
tlsKeyPath, err := cmd.Flags().GetString("tls-key")
84+
if err != nil {
85+
return err
86+
}
87+
clientCAPath, err := cmd.Flags().GetString("client-ca")
88+
if err != nil {
89+
return err
90+
}
7891

7992
ctrl.SetLogger(zap.New(zap.UseDevMode(true)))
8093
setupLog := ctrl.Log.WithName("setup")
8194

8295
restConfig := ctrl.GetConfigOrDie()
96+
97+
// Create logrus logger for the server library
98+
logger := logrus.New()
99+
100+
// Start HTTPS server with metrics/health endpoints
101+
listenAndServe, err := server.GetListenAndServeFunc(
102+
server.WithLogger(logger),
103+
server.WithTLS(&tlsCertPath, &tlsKeyPath, &clientCAPath),
104+
server.WithKubeConfig(restConfig),
105+
)
106+
if err != nil {
107+
setupLog.Error(err, "failed to setup health/metric/pprof service")
108+
return err
109+
}
110+
111+
go func() {
112+
if err := listenAndServe(); err != nil {
113+
setupLog.Error(err, "server error")
114+
}
115+
}()
83116
le := leaderelection.GetLeaderElectionConfig(setupLog, restConfig, !disableLeaderElection)
84117

85118
packageserverCSVFields := fields.Set{"metadata.name": name}
@@ -136,14 +169,7 @@ func run(cmd *cobra.Command, args []string) error {
136169
return err
137170
}
138171

139-
if err := mgr.AddReadyzCheck("ping", healthz.Ping); err != nil {
140-
setupLog.Error(err, "failed to establish a readyz check")
141-
return err
142-
}
143-
if err := mgr.AddHealthzCheck("ping", healthz.Ping); err != nil {
144-
setupLog.Error(err, "failed to establish a healthz check")
145-
return err
146-
}
172+
// Health checks are now handled by pkg/lib/server (not controller-runtime)
147173
// +kubebuilder:scaffold:builder
148174
setupLog.Info("starting manager")
149175
if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {

‎cmd/package-server-manager/start.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ func newStartCmd() *cobra.Command {
1919
cmd.Flags().String("interval", defaultInterval, "configures the wakeup interval for the packageserver csc resource")
2020
cmd.Flags().String("metrics", defaultMetricsPort, "configures the metrics port that the process exposes")
2121
cmd.Flags().Bool("disable-leader-election", false, "configures whether leader election will be disabled")
22+
cmd.Flags().String("tls-cert", "", "path to use for certificate key (requires tls-key)")
23+
cmd.Flags().String("tls-key", "", "path to use for private key (requires tls-cert)")
24+
cmd.Flags().String("client-ca", "", "path to watch for client ca bundle")
2225

2326
return cmd
2427
}

‎manifests/0000_50_olm_06-psm-operator.deployment.ibm-cloud-managed.yaml‎

Lines changed: 18 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -31,33 +31,6 @@ spec:
3131
serviceAccountName: olm-operator-serviceaccount
3232
priorityClassName: "system-cluster-critical"
3333
containers:
34-
- args:
35-
- --secure-listen-address=0.0.0.0:8443
36-
- --upstream=http://127.0.0.1:9090/
37-
- --tls-cert-file=/etc/tls/private/tls.crt
38-
- --tls-private-key-file=/etc/tls/private/tls.key
39-
- --logtostderr=true
40-
image: quay.io/openshift/origin-kube-rbac-proxy:latest
41-
imagePullPolicy: IfNotPresent
42-
name: kube-rbac-proxy
43-
securityContext:
44-
allowPrivilegeEscalation: false
45-
readOnlyRootFilesystem: true
46-
capabilities:
47-
drop: ["ALL"]
48-
ports:
49-
- containerPort: 8443
50-
name: metrics
51-
protocol: TCP
52-
resources:
53-
requests:
54-
memory: 20Mi
55-
cpu: 10m
56-
terminationMessagePath: /dev/termination-log
57-
terminationMessagePolicy: FallbackToLogsOnError
58-
volumeMounts:
59-
- mountPath: /etc/tls/private
60-
name: package-server-manager-serving-cert
6134
- name: package-server-manager
6235
securityContext:
6336
allowPrivilegeEscalation: false
@@ -72,7 +45,12 @@ spec:
7245
- $(PACKAGESERVER_NAME)
7346
- --namespace
7447
- $(PACKAGESERVER_NAMESPACE)
75-
- "--metrics=:9090"
48+
- --tls-cert
49+
- /etc/tls/private/tls.crt
50+
- --tls-key
51+
- /etc/tls/private/tls.key
52+
- --client-ca
53+
- /etc/tls/private/tls.crt
7654
image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
7755
imagePullPolicy: IfNotPresent
7856
env:
@@ -92,17 +70,27 @@ spec:
9270
requests:
9371
cpu: 10m
9472
memory: 10Mi
73+
ports:
74+
- containerPort: 8443
75+
name: metrics
76+
protocol: TCP
9577
livenessProbe:
9678
httpGet:
9779
path: /healthz
98-
port: 8080
80+
port: 8443
81+
scheme: HTTPS
9982
initialDelaySeconds: 30
10083
readinessProbe:
10184
httpGet:
10285
path: /healthz
103-
port: 8080
86+
port: 8443
87+
scheme: HTTPS
10488
initialDelaySeconds: 30
10589
terminationMessagePolicy: FallbackToLogsOnError
90+
volumeMounts:
91+
- name: package-server-manager-serving-cert
92+
mountPath: "/etc/tls/private"
93+
readOnly: true
10694
nodeSelector:
10795
kubernetes.io/os: linux
10896
tolerations:

‎manifests/0000_50_olm_06-psm-operator.deployment.yaml‎

Lines changed: 18 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -31,33 +31,6 @@ spec:
3131
serviceAccountName: olm-operator-serviceaccount
3232
priorityClassName: "system-cluster-critical"
3333
containers:
34-
- args:
35-
- --secure-listen-address=0.0.0.0:8443
36-
- --upstream=http://127.0.0.1:9090/
37-
- --tls-cert-file=/etc/tls/private/tls.crt
38-
- --tls-private-key-file=/etc/tls/private/tls.key
39-
- --logtostderr=true
40-
image: quay.io/openshift/origin-kube-rbac-proxy:latest
41-
imagePullPolicy: IfNotPresent
42-
name: kube-rbac-proxy
43-
securityContext:
44-
allowPrivilegeEscalation: false
45-
readOnlyRootFilesystem: true
46-
capabilities:
47-
drop: ["ALL"]
48-
ports:
49-
- containerPort: 8443
50-
name: metrics
51-
protocol: TCP
52-
resources:
53-
requests:
54-
memory: 20Mi
55-
cpu: 10m
56-
terminationMessagePath: /dev/termination-log
57-
terminationMessagePolicy: FallbackToLogsOnError
58-
volumeMounts:
59-
- mountPath: /etc/tls/private
60-
name: package-server-manager-serving-cert
6134
- name: package-server-manager
6235
securityContext:
6336
allowPrivilegeEscalation: false
@@ -72,7 +45,12 @@ spec:
7245
- $(PACKAGESERVER_NAME)
7346
- --namespace
7447
- $(PACKAGESERVER_NAMESPACE)
75-
- "--metrics=:9090"
48+
- --tls-cert
49+
- /etc/tls/private/tls.crt
50+
- --tls-key
51+
- /etc/tls/private/tls.key
52+
- --client-ca
53+
- /etc/tls/private/tls.crt
7654
image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
7755
imagePullPolicy: IfNotPresent
7856
env:
@@ -92,17 +70,27 @@ spec:
9270
requests:
9371
cpu: 10m
9472
memory: 10Mi
73+
ports:
74+
- containerPort: 8443
75+
name: metrics
76+
protocol: TCP
9577
livenessProbe:
9678
httpGet:
9779
path: /healthz
98-
port: 8080
80+
port: 8443
81+
scheme: HTTPS
9982
initialDelaySeconds: 30
10083
readinessProbe:
10184
httpGet:
10285
path: /healthz
103-
port: 8080
86+
port: 8443
87+
scheme: HTTPS
10488
initialDelaySeconds: 30
10589
terminationMessagePolicy: FallbackToLogsOnError
90+
volumeMounts:
91+
- name: package-server-manager-serving-cert
92+
mountPath: "/etc/tls/private"
93+
readOnly: true
10694
nodeSelector:
10795
kubernetes.io/os: linux
10896
node-role.kubernetes.io/master: ""

‎microshift-manifests/0000_50_olm_06-psm-operator.deployment.ibm-cloud-managed.yaml‎

Lines changed: 18 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -31,33 +31,6 @@ spec:
3131
serviceAccountName: olm-operator-serviceaccount
3232
priorityClassName: "system-cluster-critical"
3333
containers:
34-
- args:
35-
- --secure-listen-address=0.0.0.0:8443
36-
- --upstream=http://127.0.0.1:9090/
37-
- --tls-cert-file=/etc/tls/private/tls.crt
38-
- --tls-private-key-file=/etc/tls/private/tls.key
39-
- --logtostderr=true
40-
image: quay.io/openshift/origin-kube-rbac-proxy:latest
41-
imagePullPolicy: IfNotPresent
42-
name: kube-rbac-proxy
43-
securityContext:
44-
allowPrivilegeEscalation: false
45-
readOnlyRootFilesystem: true
46-
capabilities:
47-
drop: ["ALL"]
48-
ports:
49-
- containerPort: 8443
50-
name: metrics
51-
protocol: TCP
52-
resources:
53-
requests:
54-
memory: 20Mi
55-
cpu: 10m
56-
terminationMessagePath: /dev/termination-log
57-
terminationMessagePolicy: FallbackToLogsOnError
58-
volumeMounts:
59-
- mountPath: /etc/tls/private
60-
name: package-server-manager-serving-cert
6134
- name: package-server-manager
6235
securityContext:
6336
allowPrivilegeEscalation: false
@@ -72,7 +45,12 @@ spec:
7245
- $(PACKAGESERVER_NAME)
7346
- --namespace
7447
- $(PACKAGESERVER_NAMESPACE)
75-
- "--metrics=:9090"
48+
- --tls-cert
49+
- /etc/tls/private/tls.crt
50+
- --tls-key
51+
- /etc/tls/private/tls.key
52+
- --client-ca
53+
- /etc/tls/private/tls.crt
7654
image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
7755
imagePullPolicy: IfNotPresent
7856
env:
@@ -92,17 +70,27 @@ spec:
9270
requests:
9371
cpu: 10m
9472
memory: 10Mi
73+
ports:
74+
- containerPort: 8443
75+
name: metrics
76+
protocol: TCP
9577
livenessProbe:
9678
httpGet:
9779
path: /healthz
98-
port: 8080
80+
port: 8443
81+
scheme: HTTPS
9982
initialDelaySeconds: 30
10083
readinessProbe:
10184
httpGet:
10285
path: /healthz
103-
port: 8080
86+
port: 8443
87+
scheme: HTTPS
10488
initialDelaySeconds: 30
10589
terminationMessagePolicy: FallbackToLogsOnError
90+
volumeMounts:
91+
- name: package-server-manager-serving-cert
92+
mountPath: "/etc/tls/private"
93+
readOnly: true
10694
nodeSelector:
10795
kubernetes.io/os: linux
10896
tolerations:

0 commit comments

Comments
 (0)