@@ -6,11 +6,15 @@ import (
66 "fmt"
77 "net/http"
88 "path/filepath"
9+ "time"
910
1011 "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/filemonitor"
1112 "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/profile"
1213 "github.com/prometheus/client_golang/prometheus/promhttp"
1314 "github.com/sirupsen/logrus"
15+ "k8s.io/client-go/rest"
16+ "sigs.k8s.io/controller-runtime/pkg/log"
17+ "sigs.k8s.io/controller-runtime/pkg/metrics/filters"
1418)
1519
1620// Option applies a configuration option to the given config.
@@ -43,11 +47,18 @@ func WithDebug(debug bool) Option {
4347 }
4448}
4549
50+ func WithKubeConfig (config * rest.Config ) Option {
51+ return func (sc * serverConfig ) {
52+ sc .kubeConfig = config
53+ }
54+ }
55+
4656type serverConfig struct {
4757 logger * logrus.Logger
4858 tlsCertPath * string
4959 tlsKeyPath * string
5060 clientCAPath * string
61+ kubeConfig * rest.Config
5162 debug bool
5263}
5364
@@ -62,6 +73,7 @@ func defaultServerConfig() serverConfig {
6273 tlsCertPath : nil ,
6374 tlsKeyPath : nil ,
6475 clientCAPath : nil ,
76+ kubeConfig : nil ,
6577 logger : nil ,
6678 debug : false ,
6779 }
@@ -90,12 +102,53 @@ func (sc serverConfig) getListenAndServeFunc() (func() error, error) {
90102 }
91103
92104 mux := http .NewServeMux ()
93- mux .Handle ("/metrics" , promhttp .Handler ())
94105 mux .HandleFunc ("/healthz" , func (w http.ResponseWriter , r * http.Request ) {
95106 w .WriteHeader (http .StatusOK )
96107 })
97108 profile .RegisterHandlers (mux , profile .WithTLS (tlsEnabled || ! sc .debug ))
98109
110+ // Set up authenticated metrics endpoint if kubeConfig is provided
111+ sc .logger .Infof ("DEBUG: Checking authentication setup - kubeConfig != nil: %v, tlsEnabled: %v" , sc .kubeConfig != nil , tlsEnabled )
112+ if sc .kubeConfig != nil && tlsEnabled {
113+ sc .logger .Info ("DEBUG: Setting up authenticated metrics endpoint" )
114+ // Create authentication filter using controller-runtime
115+ sc .logger .Info ("DEBUG: Creating authentication filter with controller-runtime" )
116+ filter , err := filters .WithAuthenticationAndAuthorization (sc .kubeConfig , & http.Client {
117+ Timeout : 30 * time .Second ,
118+ })
119+ if err != nil {
120+ sc .logger .Errorf ("DEBUG: Failed to create authentication filter: %v" , err )
121+ return nil , fmt .Errorf ("failed to create authentication filter: %w" , err )
122+ }
123+ sc .logger .Info ("DEBUG: Authentication filter created successfully" )
124+ // Create authenticated metrics handler
125+ sc .logger .Info ("DEBUG: Wrapping metrics handler with authentication" )
126+ logger := log .FromContext (context .Background ())
127+ authenticatedMetricsHandler , err := filter (logger , promhttp .Handler ())
128+ if err != nil {
129+ sc .logger .Errorf ("DEBUG: Failed to wrap metrics handler: %v" , err )
130+ return nil , fmt .Errorf ("failed to wrap metrics handler with authentication: %w" , err )
131+ }
132+ sc .logger .Info ("DEBUG: Metrics handler wrapped successfully" )
133+ // Add debugging wrapper to log authentication attempts
134+ debugAuthHandler := http .HandlerFunc (func (w http.ResponseWriter , r * http.Request ) {
135+ sc .logger .Infof ("DEBUG: Metrics request from %s, Auth header present: %v, User-Agent: %s" ,
136+ r .RemoteAddr , r .Header .Get ("Authorization" ) != "" , r .Header .Get ("User-Agent" ))
137+ authenticatedMetricsHandler .ServeHTTP (w , r )
138+ })
139+ mux .Handle ("/metrics" , debugAuthHandler )
140+ sc .logger .Info ("Metrics endpoint configured with authentication and authorization" )
141+ } else {
142+ // Fallback to unprotected metrics (for development/testing)
143+ sc .logger .Warnf ("DEBUG: Using unprotected metrics - kubeConfig != nil: %v, tlsEnabled: %v" , sc .kubeConfig != nil , tlsEnabled )
144+ mux .Handle ("/metrics" , promhttp .Handler ())
145+ if sc .kubeConfig == nil {
146+ sc .logger .Warn ("No Kubernetes config provided - metrics endpoint will be unprotected" )
147+ } else if ! tlsEnabled {
148+ sc .logger .Warn ("TLS not enabled - metrics endpoint will be unprotected" )
149+ }
150+ }
151+
99152 s := http.Server {
100153 Handler : mux ,
101154 Addr : sc .getAddress (tlsEnabled ),
@@ -141,6 +194,7 @@ func (sc serverConfig) getListenAndServeFunc() (func() error, error) {
141194 ClientAuth : tls .VerifyClientCertIfGiven ,
142195 }, nil
143196 },
197+ NextProtos : []string {"http/1.1" }, // Disable HTTP/2 for security
144198 }
145199 return func () error {
146200 return s .ListenAndServeTLS ("" , "" )
0 commit comments