Use controller-runtime to protect metrics endpoint #228
Conversation
|
/test test-e2e-grc-framework |
|
@zyjjay: No presubmit jobs available for open-cluster-management-io/governance-policy-propagator@main In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
deploy/rbac/auth_cluster_role.yaml
Outdated
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRole | ||
| metadata: | ||
| name: governance-policy-propagator-auth |
There was a problem hiding this comment.
Could you reuse the governance-policy-propagator ClusterRole?
deploy/rbac/metrics_reader.yaml
Outdated
| @@ -0,0 +1,23 @@ | |||
| --- | |||
| apiVersion: rbac.authorization.k8s.io/v1 | |||
There was a problem hiding this comment.
Why does the Propagator service account need this ClusterRole? My understanding is that whatever scrapes the metrics (i.e. Prometheus) needs this and not controller serving the metrics. I think this can be removed.
Use the new `FilterProvider` and `SecureServing` fields to authenticate and authorize requests to the metrics endpoint ref: https://issues.redhat.com/browse/ACM-8346 Signed-off-by: Jason Zhang <[email protected]>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: mprahl, zyjjay The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
bot
merged commit 3a0df09
into
open-cluster-management-io:main
Use the new
FilterProviderandSecureServingfields to authenticate and authorize requests to the metrics endpointref: https://issues.redhat.com/browse/ACM-8346