Skip to content

Commit 6377fc0

Browse files
gianlucam76gianlucam76
authored
Merge pull request #472 from gianlucam76/remove-rbac-proxy
Update drift-detection-manager post rbac proxy removal
2 parents 11ec178 + 276f30e commit 6377fc0

9 files changed

+64
-258
lines changed

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ ARCH ?= amd64
2525
OS ?= $(shell uname -s | tr A-Z a-z)
2626
K8S_LATEST_VER ?= $(shell curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)
2727
export CONTROLLER_IMG ?= $(REGISTRY)/$(IMAGE_NAME)
28-
TAG ?= v0.24.0
28+
TAG ?= dev
2929

3030
.PHONY: all
3131
all: build

‎config/default/manager_auth_proxy_patch.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,4 @@ spec:
1515
- "--report-mode=0"
1616
- --shard-key=
1717
- "--v=5"
18-
- "--version=v0.24.0"
18+
- "--version=dev"

‎config/default/manager_image_patch.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,5 @@ spec:
88
spec:
99
containers:
1010
# Change the value of image field below to your controller image URL
11-
- image: projectsveltos/addon-controller-amd64:v0.24.0
11+
- image: projectsveltos/addon-controller-amd64:dev
1212
name: controller

‎manifest/deployment-shard.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,10 @@ spec:
2323
- --report-mode=0
2424
- --shard-key={{.SHARD}}
2525
- --v=5
26-
- --version=v0.24.0
26+
- --version=dev
2727
command:
2828
- /manager
29-
image: projectsveltos/addon-controller-amd64:v0.24.0
29+
image: projectsveltos/addon-controller-amd64:dev
3030
livenessProbe:
3131
failureThreshold: 3
3232
httpGet:

‎manifest/manifest.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -3350,10 +3350,10 @@ spec:
33503350
- --report-mode=0
33513351
- --shard-key=
33523352
- --v=5
3353-
- --version=v0.24.0
3353+
- --version=dev
33543354
command:
33553355
- /manager
3356-
image: projectsveltos/addon-controller-amd64:v0.24.0
3356+
image: projectsveltos/addon-controller-amd64:dev
33573357
livenessProbe:
33583358
failureThreshold: 3
33593359
httpGet:

‎pkg/drift-detection/drift-detection-manager-in-mgmt-cluster.go

+2-41
Original file line numberDiff line numberDiff line change
@@ -16,23 +16,7 @@ limitations under the License.
1616
*/
1717
package driftdetection
1818

19-
var driftDetectionInMgmtClusterYAML = []byte(`apiVersion: v1
20-
kind: Service
21-
metadata:
22-
labels:
23-
control-plane: $NAME
24-
name: $NAME-metrics-service
25-
namespace: projectsveltos
26-
spec:
27-
ports:
28-
- name: https
29-
port: 8443
30-
protocol: TCP
31-
targetPort: https
32-
selector:
33-
control-plane: $NAME
34-
---
35-
apiVersion: apps/v1
19+
var driftDetectionInMgmtClusterYAML = []byte(`apiVersion: apps/v1
3620
kind: Deployment
3721
metadata:
3822
labels:
@@ -63,7 +47,7 @@ spec:
6347
- --run-mode=do-not-send-updates
6448
command:
6549
- /manager
66-
image: projectsveltos/drift-detection-manager-amd64:v0.24.0
50+
image: projectsveltos/drift-detection-manager-amd64:dev
6751
livenessProbe:
6852
httpGet:
6953
path: /healthz
@@ -89,29 +73,6 @@ spec:
8973
capabilities:
9074
drop:
9175
- ALL
92-
- args:
93-
- --secure-listen-address=0.0.0.0:8443
94-
- --upstream=http://127.0.0.1:8080/
95-
- --logtostderr=true
96-
- --v=0
97-
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.12.0
98-
name: kube-rbac-proxy
99-
ports:
100-
- containerPort: 8443
101-
name: https
102-
protocol: TCP
103-
resources:
104-
limits:
105-
cpu: 500m
106-
memory: 128Mi
107-
requests:
108-
cpu: 5m
109-
memory: 64Mi
110-
securityContext:
111-
allowPrivilegeEscalation: false
112-
capabilities:
113-
drop:
114-
- ALL
11576
securityContext:
11677
runAsNonRoot: true
11778
serviceAccountName: drift-detection-manager

‎pkg/drift-detection/drift-detection-manager-in-mgmt-cluster.yaml

+1-40
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,3 @@
1-
apiVersion: v1
2-
kind: Service
3-
metadata:
4-
labels:
5-
control-plane: $NAME
6-
name: $NAME-metrics-service
7-
namespace: projectsveltos
8-
spec:
9-
ports:
10-
- name: https
11-
port: 8443
12-
protocol: TCP
13-
targetPort: https
14-
selector:
15-
control-plane: $NAME
16-
---
171
apiVersion: apps/v1
182
kind: Deployment
193
metadata:
@@ -45,7 +29,7 @@ spec:
4529
- --run-mode=do-not-send-updates
4630
command:
4731
- /manager
48-
image: projectsveltos/drift-detection-manager-amd64:v0.24.0
32+
image: projectsveltos/drift-detection-manager-amd64:dev
4933
livenessProbe:
5034
httpGet:
5135
path: /healthz
@@ -71,29 +55,6 @@ spec:
7155
capabilities:
7256
drop:
7357
- ALL
74-
- args:
75-
- --secure-listen-address=0.0.0.0:8443
76-
- --upstream=http://127.0.0.1:8080/
77-
- --logtostderr=true
78-
- --v=0
79-
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.12.0
80-
name: kube-rbac-proxy
81-
ports:
82-
- containerPort: 8443
83-
name: https
84-
protocol: TCP
85-
resources:
86-
limits:
87-
cpu: 500m
88-
memory: 128Mi
89-
requests:
90-
cpu: 5m
91-
memory: 64Mi
92-
securityContext:
93-
allowPrivilegeEscalation: false
94-
capabilities:
95-
drop:
96-
- ALL
9758
securityContext:
9859
runAsNonRoot: true
9960
serviceAccountName: drift-detection-manager

‎pkg/drift-detection/drift-detection-manager.go

+27-85
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,18 @@ rules:
4040
- get
4141
- list
4242
- watch
43+
- apiGroups:
44+
- authentication.k8s.io
45+
resources:
46+
- tokenreviews
47+
verbs:
48+
- create
49+
- apiGroups:
50+
- authorization.k8s.io
51+
resources:
52+
- subjectaccessreviews
53+
verbs:
54+
- create
4355
- apiGroups:
4456
- lib.projectsveltos.io
4557
resources:
@@ -76,34 +88,6 @@ rules:
7688
- update
7789
---
7890
apiVersion: rbac.authorization.k8s.io/v1
79-
kind: ClusterRole
80-
metadata:
81-
name: drift-detection-metrics-reader
82-
rules:
83-
- nonResourceURLs:
84-
- /metrics
85-
verbs:
86-
- get
87-
---
88-
apiVersion: rbac.authorization.k8s.io/v1
89-
kind: ClusterRole
90-
metadata:
91-
name: drift-detection-proxy-role
92-
rules:
93-
- apiGroups:
94-
- authentication.k8s.io
95-
resources:
96-
- tokenreviews
97-
verbs:
98-
- create
99-
- apiGroups:
100-
- authorization.k8s.io
101-
resources:
102-
- subjectaccessreviews
103-
verbs:
104-
- create
105-
---
106-
apiVersion: rbac.authorization.k8s.io/v1
10791
kind: ClusterRoleBinding
10892
metadata:
10993
name: drift-detection-manager-rolebinding
@@ -116,35 +100,6 @@ subjects:
116100
name: drift-detection-manager
117101
namespace: projectsveltos
118102
---
119-
apiVersion: rbac.authorization.k8s.io/v1
120-
kind: ClusterRoleBinding
121-
metadata:
122-
name: drift-detection-proxy-rolebinding
123-
roleRef:
124-
apiGroup: rbac.authorization.k8s.io
125-
kind: ClusterRole
126-
name: drift-detection-proxy-role
127-
subjects:
128-
- kind: ServiceAccount
129-
name: drift-detection-manager
130-
namespace: projectsveltos
131-
---
132-
apiVersion: v1
133-
kind: Service
134-
metadata:
135-
labels:
136-
control-plane: drift-detection-manager
137-
name: drift-detection-manager-metrics-service
138-
namespace: projectsveltos
139-
spec:
140-
ports:
141-
- name: https
142-
port: 8443
143-
protocol: TCP
144-
targetPort: https
145-
selector:
146-
control-plane: drift-detection-manager
147-
---
148103
apiVersion: apps/v1
149104
kind: Deployment
150105
metadata:
@@ -166,8 +121,7 @@ spec:
166121
spec:
167122
containers:
168123
- args:
169-
- --health-probe-bind-address=:8081
170-
- --metrics-bind-address=127.0.0.1:8080
124+
- --diagnostics-address=:8443
171125
- --v=5
172126
- --cluster-namespace=
173127
- --cluster-name=
@@ -176,18 +130,29 @@ spec:
176130
- --run-mode=do-not-send-updates
177131
command:
178132
- /manager
179-
image: projectsveltos/drift-detection-manager-amd64:v0.24.0
133+
image: projectsveltos/drift-detection-manager-amd64:dev
180134
livenessProbe:
135+
failureThreshold: 3
181136
httpGet:
182137
path: /healthz
183-
port: 8081
138+
port: healthz
139+
scheme: HTTP
184140
initialDelaySeconds: 15
185141
periodSeconds: 20
186142
name: manager
143+
ports:
144+
- containerPort: 8443
145+
name: metrics
146+
protocol: TCP
147+
- containerPort: 9440
148+
name: healthz
149+
protocol: TCP
187150
readinessProbe:
151+
failureThreshold: 3
188152
httpGet:
189153
path: /readyz
190-
port: 8081
154+
port: healthz
155+
scheme: HTTP
191156
initialDelaySeconds: 5
192157
periodSeconds: 10
193158
resources:
@@ -202,29 +167,6 @@ spec:
202167
capabilities:
203168
drop:
204169
- ALL
205-
- args:
206-
- --secure-listen-address=0.0.0.0:8443
207-
- --upstream=http://127.0.0.1:8080/
208-
- --logtostderr=true
209-
- --v=0
210-
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.12.0
211-
name: kube-rbac-proxy
212-
ports:
213-
- containerPort: 8443
214-
name: https
215-
protocol: TCP
216-
resources:
217-
limits:
218-
cpu: 500m
219-
memory: 128Mi
220-
requests:
221-
cpu: 5m
222-
memory: 64Mi
223-
securityContext:
224-
allowPrivilegeEscalation: false
225-
capabilities:
226-
drop:
227-
- ALL
228170
securityContext:
229171
runAsNonRoot: true
230172
serviceAccountName: drift-detection-manager

0 commit comments

Comments
 (0)