Skip to content

Commit c69f771

Browse files
camilamacedo86camilamacedo86
committed
Revert "Secure metrics endpoint with cntrlr-runtime metrics authz mechanics (#3660)"
This reverts commit 589a5d0.
1 parent 39145b8 commit c69f771

File tree

12 files changed

+55
-329
lines changed

12 files changed

+55
-329
lines changed

‎.github/workflows/e2e-tests.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ jobs:
8686
for i in $(seq 1 ${E2E_NODES}); do
8787
KIND_CLUSTER_NAME="kind-olmv0-${i}" \
8888
KIND_CREATE_OPTS="--kubeconfig=${E2E_KUBECONFIG_ROOT}/kubeconfig-${i}" \
89-
HELM_INSTALL_OPTS="--kubeconfig ${E2E_KUBECONFIG_ROOT}/kubeconfig-${i} --set certManager.enabled=false" \
89+
HELM_INSTALL_OPTS="--kubeconfig ${E2E_KUBECONFIG_ROOT}/kubeconfig-${i}" \
9090
make kind-create deploy;
9191
done
9292
@@ -173,7 +173,7 @@ jobs:
173173
for i in $(seq 1 ${E2E_NODES}); do
174174
KIND_CLUSTER_NAME="kind-olmv0-${i}" \
175175
KIND_CREATE_OPTS="--kubeconfig=${E2E_KUBECONFIG_ROOT}/kubeconfig-${i}" \
176-
HELM_INSTALL_OPTS="--kubeconfig ${E2E_KUBECONFIG_ROOT}/kubeconfig-${i} --set certManager.enabled=false" \
176+
HELM_INSTALL_OPTS="--kubeconfig ${E2E_KUBECONFIG_ROOT}/kubeconfig-${i}" \
177177
make kind-create deploy;
178178
done
179179

‎Makefile‎

Lines changed: 2 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -48,12 +48,6 @@ GINKGO := $(TOOL_EXEC) github.com/onsi/ginkgo/v2/ginkgo
4848

4949
# Target environment and Dependencies #
5050

51-
# Cert-manager version - update this for new releases
52-
CERT_MANAGER_VERSION ?= v1.18.2
53-
54-
# Cert-manager deployment timeout
55-
CERT_MANAGER_TIMEOUT ?= 120s
56-
5751
# Minor Kubernetes version to build against derived from the client-go dependency version
5852
KUBE_MINOR ?= $(shell go list -m k8s.io/client-go | cut -d" " -f2 | sed 's/^v0\.\([[:digit:]]\{1,\}\)\.[[:digit:]]\{1,\}$$/1.\1/')
5953

@@ -163,29 +157,7 @@ local-build: IMAGE_TAG = local
163157
local-build: image
164158

165159
.PHONY: run-local
166-
run-local: local-build kind-create cert-manager-install deploy
167-
168-
.PHONY: cert-manager-install
169-
cert-manager-install: #HELP Install cert-manager $(CERT_MANAGER_VERSION)
170-
@echo "Installing cert-manager $(CERT_MANAGER_VERSION)"
171-
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/$(CERT_MANAGER_VERSION)/cert-manager.yaml
172-
@echo "Waiting for cert-manager to be ready..."
173-
kubectl wait --for=condition=Available --namespace=cert-manager deployment/cert-manager --timeout=$(CERT_MANAGER_TIMEOUT)
174-
kubectl wait --for=condition=Available --namespace=cert-manager deployment/cert-manager-cainjector --timeout=$(CERT_MANAGER_TIMEOUT)
175-
kubectl wait --for=condition=Available --namespace=cert-manager deployment/cert-manager-webhook --timeout=$(CERT_MANAGER_TIMEOUT)
176-
@echo "Waiting for cert-manager webhook to be ready..."
177-
kubectl wait --for=condition=Ready --namespace=cert-manager pod -l app=webhook --timeout=$(CERT_MANAGER_TIMEOUT)
178-
@echo "Waiting for cert-manager CRDs to be available..."
179-
kubectl wait --for condition=established --timeout=$(CERT_MANAGER_TIMEOUT) crd/certificates.cert-manager.io
180-
kubectl wait --for condition=established --timeout=$(CERT_MANAGER_TIMEOUT) crd/issuers.cert-manager.io
181-
@echo "cert-manager $(CERT_MANAGER_VERSION) installed successfully"
182-
183-
.PHONY: cert-manager-uninstall
184-
cert-manager-uninstall: #HELP Uninstall cert-manager
185-
@echo "Uninstalling cert-manager..."
186-
kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/$(CERT_MANAGER_VERSION)/cert-manager.yaml --ignore-not-found=true
187-
@echo "cert-manager uninstalled"
188-
160+
run-local: local-build kind-create deploy
189161

190162
.PHONY: clean
191163
clean: #HELP Clean up build artifacts
@@ -259,7 +231,6 @@ deploy: $(KIND) $(HELM) #HELP Deploy OLM to kind cluster $KIND_CLUSTER_NAME (def
259231
$(KIND) load docker-image $(OLM_IMAGE) --name $(KIND_CLUSTER_NAME); \
260232
$(HELM) upgrade --install olm deploy/chart \
261233
--set debug=true \
262-
--set certManager.enabled=true \
263234
--set olm.image.ref=$(OLM_IMAGE) \
264235
--set olm.image.pullPolicy=IfNotPresent \
265236
--set catalog.image.ref=$(OLM_IMAGE) \
@@ -283,9 +254,6 @@ undeploy: $(KIND) $(HELM) #HELP Uninstall OLM from kind cluster $KIND_CLUSTER_NA
283254
$(HELM) uninstall olm
284255
kubectl delete -f deploy/chart/crds
285256

286-
# Uninstall cert-manager
287-
$(MAKE) cert-manager-uninstall
288-
289257
#SECTION e2e
290258

291259
# E2E test configuration
@@ -301,24 +269,7 @@ e2e: #HELP Run e2e tests against a cluster running OLM (params: $E2E_TEST_NS (op
301269
$(GO_TEST_ENV) $(GINKGO) -timeout $(E2E_TIMEOUT) $(GINKGO_OPTS) $(E2E_GINKGO_OPTS) ./test/e2e -- -namespace=$(E2E_TEST_NS) -olmNamespace=$(E2E_INSTALL_NS) -catalogNamespace=$(E2E_CATALOG_NS) $(E2E_OPTS)
302270

303271
.PHONY: e2e-local
304-
e2e-local: e2e-build kind-create e2e-local-deploy e2e
305-
306-
.PHONY: e2e-local-deploy
307-
e2e-local-deploy: $(KIND) $(HELM) #HELP Deploy OLM for e2e testing (without cert-manager)
308-
$(KIND) load docker-image $(OLM_IMAGE) --name $(KIND_CLUSTER_NAME); \
309-
$(HELM) upgrade --install olm deploy/chart \
310-
--set debug=true \
311-
--set certManager.enabled=false \
312-
--set olm.image.ref=$(OLM_IMAGE) \
313-
--set olm.image.pullPolicy=IfNotPresent \
314-
--set catalog.image.ref=$(OLM_IMAGE) \
315-
--set catalog.image.pullPolicy=IfNotPresent \
316-
--set catalog.commandArgs=--configmapServerImage=$(CONFIGMAP_SERVER_IMAGE) \
317-
--set catalog.opmImageArgs=--opmImage=$(OPERATOR_REGISTRY_IMAGE) \
318-
--set package.image.ref=$(OLM_IMAGE) \
319-
--set package.image.pullPolicy=IfNotPresent \
320-
$(HELM_INSTALL_OPTS) \
321-
--wait;
272+
e2e-local: e2e-build kind-create deploy e2e
322273

323274
#SECTION Code Generation
324275

‎cmd/catalog/main.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -57,16 +57,9 @@ func (o *options) run(ctx context.Context, logger *logrus.Logger) error {
5757
o.catalogNamespace = catalogNamespaceEnvVarValue
5858
}
5959

60-
// create a config client for operator status
61-
config, err := clientcmd.BuildConfigFromFlags("", o.kubeconfig)
62-
if err != nil {
63-
return fmt.Errorf("error configuring client: %s", err.Error())
64-
}
65-
6660
listenAndServe, err := server.GetListenAndServeFunc(
6761
server.WithLogger(logger),
6862
server.WithTLS(&o.tlsCertPath, &o.tlsKeyPath, &o.clientCAPath),
69-
server.WithKubeConfig(config),
7063
server.WithDebug(o.debug),
7164
)
7265
if err != nil {
@@ -79,6 +72,11 @@ func (o *options) run(ctx context.Context, logger *logrus.Logger) error {
7972
}
8073
}()
8174

75+
// create a config client for operator status
76+
config, err := clientcmd.BuildConfigFromFlags("", o.kubeconfig)
77+
if err != nil {
78+
return fmt.Errorf("error configuring client: %s", err.Error())
79+
}
8280
configClient, err := configv1client.NewForConfig(config)
8381
if err != nil {
8482
return fmt.Errorf("error configuring client: %s", err.Error())

‎cmd/olm/main.go‎

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -123,18 +123,7 @@ func main() {
123123
}
124124
logger.Infof("log level %s", logger.Level)
125125

126-
mgr, err := Manager(ctx, *debug)
127-
if err != nil {
128-
logger.WithError(err).Fatal("error configuring controller manager")
129-
}
130-
config := mgr.GetConfig()
131-
132-
listenAndServe, err := server.GetListenAndServeFunc(
133-
server.WithLogger(logger),
134-
server.WithTLS(tlsCertPath, tlsKeyPath, clientCAPath),
135-
server.WithKubeConfig(config),
136-
server.WithDebug(*debug),
137-
)
126+
listenAndServe, err := server.GetListenAndServeFunc(server.WithLogger(logger), server.WithTLS(tlsCertPath, tlsKeyPath, clientCAPath), server.WithDebug(*debug))
138127
if err != nil {
139128
logger.Fatalf("Error setting up health/metric/pprof service: %v", err)
140129
}
@@ -145,6 +134,12 @@ func main() {
145134
}
146135
}()
147136

137+
mgr, err := Manager(ctx, *debug)
138+
if err != nil {
139+
logger.WithError(err).Fatal("error configuring controller manager")
140+
}
141+
config := mgr.GetConfig()
142+
148143
// create a config that validates we're creating objects with labels
149144
validatingConfig := validatingroundtripper.Wrap(config, mgr.GetScheme())
150145

‎deploy/chart/templates/0000_50_olm_04-cert-manager.yaml‎

Lines changed: 0 additions & 46 deletions
This file was deleted.

‎deploy/chart/templates/0000_50_olm_07-olm-operator.deployment.yaml‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,16 @@ spec:
2222
seccompProfile:
2323
type: RuntimeDefault
2424
serviceAccountName: olm-operator-serviceaccount
25-
volumes:
26-
{{- if .Values.certManager.enabled }}
25+
volumes:
26+
{{- if .Values.olm.tlsSecret }}
2727
- name: srv-cert
2828
secret:
29-
secretName: {{ .Values.certManager.certificate.secretName }}
29+
secretName: {{ .Values.olm.tlsSecret }}
30+
{{- end }}
31+
{{- if .Values.olm.clientCASecret }}
3032
- name: profile-collector-cert
3133
secret:
32-
secretName: {{ .Values.certManager.certificate.secretName }}
34+
secretName: {{ .Values.olm.clientCASecret }}
3335
{{- end }}
3436
- name: tmpfs
3537
emptyDir: {}
@@ -41,10 +43,12 @@ spec:
4143
capabilities:
4244
drop: [ "ALL" ]
4345
volumeMounts:
44-
{{- if .Values.certManager.enabled }}
46+
{{- if .Values.olm.tlsSecret }}
4547
- name: srv-cert
4648
mountPath: "/srv-cert"
4749
readOnly: true
50+
{{- end }}
51+
{{- if .Values.olm.clientCASecret }}
4852
- name: profile-collector-cert
4953
mountPath: "/profile-collector-cert"
5054
readOnly: true
@@ -74,29 +78,31 @@ spec:
7478
- --writePackageServerStatusName
7579
- {{ .Values.writePackageServerStatusName }}
7680
{{- end }}
77-
{{- if .Values.certManager.enabled }}
81+
{{- if .Values.olm.tlsSecret }}
7882
- --tls-cert
7983
- /srv-cert/tls.crt
8084
- --tls-key
8185
- /srv-cert/tls.key
86+
{{- end }}
87+
{{- if .Values.olm.clientCASecret }}
8288
- --client-ca
8389
- /profile-collector-cert/tls.crt
8490
{{- end }}
8591
image: {{ .Values.olm.image.ref }}
8692
imagePullPolicy: {{ .Values.olm.image.pullPolicy }}
8793
ports:
88-
- containerPort: {{ if .Values.certManager.enabled }}{{ .Values.olm.service.internalPortHttps }}{{ else }}{{ .Values.olm.service.internalPort }}{{ end }}
94+
- containerPort: {{ .Values.olm.service.internalPort }}
8995
name: metrics
9096
livenessProbe:
9197
httpGet:
9298
path: /healthz
93-
port: {{ if .Values.certManager.enabled }}{{ .Values.olm.service.internalPortHttps }}{{ else }}{{ .Values.olm.service.internalPort }}{{ end }}
94-
scheme: {{ if .Values.certManager.enabled }}HTTPS{{ else }}HTTP{{ end }}
99+
port: {{ .Values.olm.service.internalPort }}
100+
scheme: {{ if .Values.olm.tlsSecret }}HTTPS{{ else }}HTTP{{end}}
95101
readinessProbe:
96102
httpGet:
97103
path: /healthz
98-
port: {{ if .Values.certManager.enabled }}{{ .Values.olm.service.internalPortHttps }}{{ else }}{{ .Values.olm.service.internalPort }}{{ end }}
99-
scheme: {{ if .Values.certManager.enabled }}HTTPS{{ else }}HTTP{{ end }}
104+
port: {{ .Values.olm.service.internalPort }}
105+
scheme: {{ if .Values.olm.tlsSecret }}HTTPS{{ else }}HTTP{{end}}
100106
terminationMessagePolicy: FallbackToLogsOnError
101107
env:
102108
- name: OPERATOR_NAMESPACE

‎deploy/chart/templates/0000_50_olm_08-catalog-operator.deployment.yaml‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,15 @@ spec:
2323
type: RuntimeDefault
2424
serviceAccountName: olm-operator-serviceaccount
2525
volumes:
26-
{{- if .Values.certManager.enabled }}
26+
{{- if .Values.catalog.tlsSecret }}
2727
- name: srv-cert
2828
secret:
29-
secretName: {{ .Values.certManager.certificate.secretName }}
29+
secretName: {{ .Values.catalog.tlsSecret }}
30+
{{- end }}
31+
{{- if .Values.catalog.clientCASecret }}
3032
- name: profile-collector-cert
3133
secret:
32-
secretName: {{ .Values.certManager.certificate.secretName }}
34+
secretName: {{ .Values.catalog.clientCASecret }}
3335
{{- end }}
3436
- name: tmpfs
3537
emptyDir: {}
@@ -41,10 +43,12 @@ spec:
4143
capabilities:
4244
drop: [ "ALL" ]
4345
volumeMounts:
44-
{{- if .Values.certManager.enabled }}
46+
{{- if .Values.catalog.tlsSecret }}
4547
- name: srv-cert
4648
mountPath: "/srv-cert"
4749
readOnly: true
50+
{{- end }}
51+
{{- if .Values.catalog.clientCASecret }}
4852
- name: profile-collector-cert
4953
mountPath: "/profile-collector-cert"
5054
readOnly: true
@@ -71,11 +75,13 @@ spec:
7175
- --writeStatusName
7276
- {{ .Values.writeStatusNameCatalog }}
7377
{{- end }}
74-
{{- if .Values.certManager.enabled }}
78+
{{- if .Values.catalog.tlsSecret }}
7579
- --tls-cert
7680
- /srv-cert/tls.crt
7781
- --tls-key
7882
- /srv-cert/tls.key
83+
{{- end }}
84+
{{- if .Values.catalog.clientCASecret }}
7985
- --client-ca
8086
- /profile-collector-cert/tls.crt
8187
{{- end }}
@@ -92,18 +98,18 @@ spec:
9298
{{- end }}
9399
imagePullPolicy: {{ .Values.catalog.image.pullPolicy }}
94100
ports:
95-
- containerPort: {{ if .Values.certManager.enabled }}{{ .Values.catalog.service.internalPortHttps }}{{ else }}{{ .Values.catalog.service.internalPort }}{{ end }}
101+
- containerPort: {{ .Values.olm.service.internalPort }}
96102
name: metrics
97103
livenessProbe:
98104
httpGet:
99105
path: /healthz
100-
port: {{ if .Values.certManager.enabled }}{{ .Values.catalog.service.internalPortHttps }}{{ else }}{{ .Values.catalog.service.internalPort }}{{ end }}
101-
scheme: {{ if .Values.certManager.enabled }}HTTPS{{ else }}HTTP{{ end }}
106+
port: {{ .Values.catalog.service.internalPort }}
107+
scheme: {{ if .Values.catalog.tlsSecret }}HTTPS{{ else }}HTTP{{end}}
102108
readinessProbe:
103109
httpGet:
104110
path: /healthz
105-
port: {{ if .Values.certManager.enabled }}{{ .Values.catalog.service.internalPortHttps }}{{ else }}{{ .Values.catalog.service.internalPort }}{{ end }}
106-
scheme: {{ if .Values.certManager.enabled }}HTTPS{{ else }}HTTP{{ end }}
111+
port: {{ .Values.catalog.service.internalPort }}
112+
scheme: {{ if .Values.catalog.tlsSecret }}HTTPS{{ else }}HTTP{{end}}
107113
terminationMessagePolicy: FallbackToLogsOnError
108114
{{- if .Values.catalog.resources }}
109115
resources:

‎deploy/chart/templates/_helpers.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,4 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
1313
{{- define "fullname" -}}
1414
{{- $name := default .Chart.Name .Values.nameOverride -}}
1515
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
16-
{{- end -}}
16+
{{- end -}}

0 commit comments

Comments
 (0)