remove kube-rbac-proxy

Author: freeznet

config/default/manager_auth_proxy_patch.yaml

@@ -9,25 +9,12 @@ spec:
   template:
     spec:
       containers:
-      - name: kube-rbac-proxy
-        image: docker.cloudsmith.io/streamnative/mirrors/gcr.io/kubebuilder/kube-rbac-proxy@sha256:67ecb332573384515406ebd71816781366b70adb0eb66345e5980e92603373e1
-        args:
-        - "--secure-listen-address=0.0.0.0:8443"
-        - "--upstream=http://127.0.0.1:8080/"
-        - "--logtostderr=true"
-        - "--v=10"
-        ports:
-        - containerPort: 8443
-          name: https
-        resources:
-          limits:
-            cpu: 500m
-            memory: 500Mi
-          requests:
-            cpu: 100m
-            memory: 20Mi
       - name: manager
         args:
-        - "--metrics-addr=127.0.0.1:8080"
+        - "--metrics-addr=0.0.0.0:8443"
         - "--enable-leader-election"
         - "--namespaced-backend-config=backend-config"
+        ports:
+          - containerPort: 8443
+            name: metrics
+            protocol: TCP

config/manifests/bases/function-mesh.clusterserviceversion.yaml

@@ -5,7 +5,7 @@ metadata:
     alm-examples: '[]'
     capabilities: Full Lifecycle
     categories: Streaming & Messaging
-    containerImage: streamnative/function-mesh-operator:v0.0.0
+    containerImage: docker-proxy.streamnative.io/streamnative/function-mesh-operator:v0.0.0
     description: The Function Mesh Operator manages the Pulsar Functions and Connectors
       deployed on a Kubernetes cluster.
     operatorhub.io/ui-metadata-max-k8s-version: "1.26"
@@ -77,8 +77,6 @@ spec:
     name: StreamNative
     url: https://streamnative.io
   relatedImages:
-  - image: streamnative/function-mesh-operator:v0.0.0
+  - image: docker-proxy.streamnative.io/streamnative/function-mesh-operator:v0.0.0
     name: function-mesh
-  - image: docker.cloudsmith.io/streamnative/mirrors/gcr.io/kubebuilder/kube-rbac-proxy@sha256:67ecb332573384515406ebd71816781366b70adb0eb66345e5980e92603373e1
-    name: kube-rbac-proxy
   version: 0.0.0

hack/postprocess-bundle.sh

@@ -37,7 +37,6 @@ yq eval -i '.annotations."com.redhat.openshift.versions" headComment = "Certifie
 # Add relatedImages
 yq -i '.spec.relatedImages = []' bundle/manifests/function-mesh.clusterserviceversion.yaml
 yq -i '.spec.relatedImages += {"name": "function-mesh", "image": ""}' bundle/manifests/function-mesh.clusterserviceversion.yaml
-yq -i '.spec.relatedImages += {"name": "kube-rbac-proxy", "image": "docker.cloudsmith.io/streamnative/mirrors/gcr.io/kubebuilder/kube-rbac-proxy@sha256:67ecb332573384515406ebd71816781366b70adb0eb66345e5980e92603373e1"}' bundle/manifests/function-mesh.clusterserviceversion.yaml
 yq -i '.spec.relatedImages[0].image += env(IMG_DIGEST)' bundle/manifests/function-mesh.clusterserviceversion.yaml
 
 # Add feature annotations (required)

main.go

@@ -27,6 +27,7 @@ import (
 	"github.com/streamnative/function-mesh/pkg/monitoring"
 	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
+	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
 	"sigs.k8s.io/controller-runtime/pkg/metrics/server"
 
 	"github.com/go-logr/logr"
@@ -77,7 +78,8 @@ func main() {
 	var globalBackendConfig string
 	var globalBackendConfigNamespace string
 	var namespacedBackendConfig string
-	flag.StringVar(&metricsAddr, "metrics-addr", lookupEnvOrString("METRICS_ADDR", ":8080"),
+	var secureMetrics bool
+	flag.StringVar(&metricsAddr, "metrics-addr", lookupEnvOrString("METRICS_ADDR", ":8443"),
 		"The address the metric endpoint binds to.")
 	flag.StringVar(&leaderElectionID, "leader-election-id",
 		lookupEnvOrString("LEADER_ELECTION_ID", "a3f45fce.functionmesh.io"),
@@ -108,6 +110,8 @@ func main() {
 		"The namespace of the global backend config name used for all functions&sinks&sources")
 	flag.StringVar(&namespacedBackendConfig, "namespaced-backend-config", lookupEnvOrString("NAMESPACED_BACKEND_CONFIG", "backend-config"),
 		"The backend config name used for functions&sinks&sources in the same namespace")
+	flag.BoolVar(&secureMetrics, "metrics-secure", true, "If set, the metrics endpoint is served securely via HTTPS."+
+		" Use --metrics-secure=false to use HTTP instead.")
 	flag.Parse()
 
 	ctrl.SetLogger(zap.New(zap.UseDevMode(true)))
@@ -133,11 +137,18 @@ func main() {
 		}
 	}
 
+	metricOpts := server.Options{
+		BindAddress:   metricsAddr,
+		SecureServing: secureMetrics,
+	}
+
+	if secureMetrics {
+		metricOpts.FilterProvider = filters.WithAuthenticationAndAuthorization
+	}
+
 	options := ctrl.Options{
-		Scheme: scheme,
-		Metrics: server.Options{
-			BindAddress: metricsAddr,
-		},
+		Scheme:                  scheme,
+		Metrics:                 metricOpts,
 		HealthProbeBindAddress:  healthProbeAddr,
 		LeaderElection:          enableLeaderElection,
 		LeaderElectionNamespace: leaderElectionNamespace,