@@ -45,6 +45,7 @@ import (
4545 "sigs.k8s.io/controller-runtime/pkg/controller"
4646 "sigs.k8s.io/controller-runtime/pkg/healthz"
4747 "sigs.k8s.io/controller-runtime/pkg/manager"
48+ "sigs.k8s.io/controller-runtime/pkg/metrics/filters"
4849 metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
4950 "sigs.k8s.io/controller-runtime/pkg/webhook"
5051
@@ -62,8 +63,8 @@ import (
6263
6364var (
6465 setupLog = ctrl .Log .WithName ("setup" )
65- metricsAddr string
66- probeAddr string
66+ diagnosticsAddress string
67+ insecureDiagnostics bool
6768 shardKey string
6869 workers int
6970 concurrentReconciles int
7576 webhookPort int
7677 syncPeriod time.Duration
7778 version string
79+ healthAddr string
7880)
7981
8082const (
@@ -84,6 +86,10 @@ const (
8486 defaulReportMode = int (controllers .CollectFromManagementCluster )
8587)
8688
89+ // Add RBAC for the authorized diagnostics endpoint.
90+ // +kubebuilder:rbac:groups=authentication.k8s.io,resources=tokenreviews,verbs=create
91+ // +kubebuilder:rbac:groups=authorization.k8s.io,resources=subjectaccessreviews,verbs=create
92+
8793func main () {
8894 scheme , err := controllers .InitScheme ()
8995 if err != nil {
@@ -103,10 +109,8 @@ func main() {
103109
104110 ctrlOptions := ctrl.Options {
105111 Scheme : scheme ,
106- HealthProbeBindAddress : probeAddr ,
107- Metrics : metricsserver.Options {
108- BindAddress : metricsAddr ,
109- },
112+ Metrics : getDiagnosticsOptions (),
113+ HealthProbeBindAddress : healthAddr ,
110114 WebhookServer : webhook .NewServer (
111115 webhook.Options {
112116 Port : webhookPort ,
@@ -193,15 +197,13 @@ func initFlags(fs *pflag.FlagSet) {
193197 false ,
194198 "When set, indicates drift-detection-manager needs to be started in the management cluster" )
195199
196- fs .StringVar (& metricsAddr ,
197- "metrics-bind- address" ,
198- ":8080" ,
199- "The address the metric endpoint binds to ."
200+ fs .StringVar (& diagnosticsAddress , "diagnostics-address" , ":8443" ,
201+ "The address the diagnostics endpoint binds to. Per default metrics are served via https and with" +
202+ "authentication/authorization. To serve via http and without authentication/authorization set --insecure-diagnostics." +
203+ "If --insecure-diagnostics is not set the diagnostics endpoint also serves pprof endpoints and an endpoint to change the log level ."
200204
201- fs .StringVar (& probeAddr ,
202- "health-probe-bind-address" ,
203- ":8081" ,
204- "The address the probe endpoint binds to." )
205+ fs .BoolVar (& insecureDiagnostics , "insecure-diagnostics" , false ,
206+ "Enable insecure diagnostics serving. For more details see the description of --diagnostics-address." )
205207
206208 fs .StringVar (& shardKey ,
207209 "shard-key" ,
@@ -225,6 +227,9 @@ func initFlags(fs *pflag.FlagSet) {
225227 "" ,
226228 "current sveltos version" )
227229
230+ fs .StringVar (& healthAddr , "health-addr" , ":9440" ,
231+ "The address the health endpoint binds to." )
232+
228233 const defautlRestConfigQPS = 20
229234 fs .Float32Var (& restConfigQPS , "kube-api-qps" , defautlRestConfigQPS ,
230235 fmt .Sprintf ("Maximum queries per second from the controller client to the Kubernetes API server. Defaults to %d" ,
@@ -453,3 +458,24 @@ func getClusterSummaryReconciler(ctx context.Context, mgr manager.Manager) *cont
453458 ConcurrentReconciles : concurrentReconciles ,
454459 }
455460}
461+
462+ // getDiagnosticsOptions returns metrics options which can be used to configure a Manager.
463+ func getDiagnosticsOptions () metricsserver.Options {
464+ // If "--insecure-diagnostics" is set, serve metrics via http
465+ // and without authentication/authorization.
466+ if insecureDiagnostics {
467+ return metricsserver.Options {
468+ BindAddress : diagnosticsAddress ,
469+ SecureServing : false ,
470+ }
471+ }
472+
473+ // If "--insecure-diagnostics" is not set, serve metrics via https
474+ // and with authentication/authorization. As the endpoint is protected,
475+ // we also serve pprof endpoints and an endpoint to change the log level.
476+ return metricsserver.Options {
477+ BindAddress : diagnosticsAddress ,
478+ SecureServing : true ,
479+ FilterProvider : filters .WithAuthenticationAndAuthorization ,
480+ }
481+ }
0 commit comments