Kubebuilder scaffolding moves away from kube-rbac-proxy

[pavolloffay]

Component(s)

No response

Describe the issue you're reporting

https://github.com/kubernetes-sigs/kubebuilder/blob/master/designs/discontinue_usage_of_kube_rbac_proxy.md

The proxy is used to secure /metrics endpoint of the operator

opentelemetry-operator/bundle/openshift/manifests/opentelemetry-operator.clusterserviceversion.yaml

Line 516 in 97c8d51

- --upstream=http://127.0.0.1:8080/

On OpenShift the proxy is configured with OCP serving certs https://github.com/os-observability/konflux-opentelemetry/blob/main/bundle-patch/patch_csv.yaml#L177 and https://github.com/os-observability/konflux-opentelemetry/blob/main/bundle-patch/manifests/opentelemetry-operator-prometheus_rbac.authorization.k8s.io_v1_rolebinding.yaml#L18 cc) @iblancasa we talked about migrating this to this repo.

If we migrate away from the proxy we should ensure the metrics endpoint can be served via TLS (kubernetes-sigs/controller-runtime#2407), however there is no RBAC enforcement at the moment.

[swiatekm]

If we migrate away from the proxy we should ensure the metrics endpoint can be served via TLS (kubernetes-sigs/controller-runtime#2407), however there is no RBAC enforcement at the moment.

Looks like RBAC enforcement does work as per kubernetes-sigs/kubebuilder#3907.

[camilamacedo86]

Hi @pavolloffay

If you can upgrade the solution to the latest scaffold provided by Kubebuilder, you will have protection in place with the WithAuthenticationAndAuthorization feature provided by Controller-Runtime. However, you can also do the change manually. Check out the FAQ section: "How can I manually change my project to switch to Controller-Runtime's built-in auth protection?"

This feature provides integrated support for securing metrics endpoints by embedding authentication (authn) and authorization (authz) mechanisms directly into the controller manager's metrics server, replacing the need for (https://github.com/brancz/kube-rbac-proxy) to secure metrics endpoints.

🖐️ Also, see the feature available in the next release kubernetes-sigs/kubebuilder#4400 to know how to use certs within.

I hope that helps out.