Skip to content

Commit ccd09f7

Browse files
arturshadnikarturshadnik
authored
chore: remove deprecated kube-rbac-proxy (#185)
## Issue Resolves #183 ## Description `kube-rbac-proxy`, which was previously used to secure the metrics server is being deprecated. This PR: - removes all use of `kube-rbac-proxy` and switches to the new recommended method for securing the metrics server using the built-in `WithAuthenticationAndAuthorization` feature from `Controller-Runtime` - updates manifests and helm charts - small kustomize update `config/default/kustomization.yaml`. `patchesStrategicMerge` is deprecated -> `patches` --------- Signed-off-by: Artur Shad Nik <[email protected]>
1 parent a788e6e commit ccd09f7

22 files changed

+295
-295
lines changed

‎build

‎chart/validator-plugin-maas/README.md

+2-11
Original file line numberDiff line numberDiff line change
@@ -11,16 +11,7 @@ The following table lists the configurable parameters of the Validator-plugin-ma
1111

1212
| Parameter | Description | Default |
1313
| ------------------------ | ----------------------- | -------------- |
14-
| `controllerManager.kubeRbacProxy.args` | | `["--secure-listen-address=0.0.0.0:8443", "--upstream=http://127.0.0.1:8080/", "--logtostderr=true", "--v=0"]` |
15-
| `controllerManager.kubeRbacProxy.containerSecurityContext.allowPrivilegeEscalation` | | `false` |
16-
| `controllerManager.kubeRbacProxy.containerSecurityContext.capabilities.drop` | | `["ALL"]` |
17-
| `controllerManager.kubeRbacProxy.image.repository` | | `"gcr.io/kubebuilder/kube-rbac-proxy"` |
18-
| `controllerManager.kubeRbacProxy.image.tag` | | `"v0.16.0"` |
19-
| `controllerManager.kubeRbacProxy.resources.limits.cpu` | | `"500m"` |
20-
| `controllerManager.kubeRbacProxy.resources.limits.memory` | | `"128Mi"` |
21-
| `controllerManager.kubeRbacProxy.resources.requests.cpu` | | `"5m"` |
22-
| `controllerManager.kubeRbacProxy.resources.requests.memory` | | `"64Mi"` |
23-
| `controllerManager.manager.args` | | `["--health-probe-bind-address=:8081", "--leader-elect"]` |
14+
| `controllerManager.manager.args` | | `["--metrics-bind-address=:8443", "--health-probe-bind-address=:8081", "--leader-elect"]` |
2415
| `controllerManager.manager.containerSecurityContext.allowPrivilegeEscalation` | | `false` |
2516
| `controllerManager.manager.containerSecurityContext.capabilities.drop` | | `["ALL"]` |
2617
| `controllerManager.manager.image.repository` | | `"quay.io/validator-labs/validator-plugin-maas"` |
@@ -32,7 +23,7 @@ The following table lists the configurable parameters of the Validator-plugin-ma
3223
| `controllerManager.replicas` | | `1` |
3324
| `controllerManager.serviceAccount.annotations` | | `{}` |
3425
| `kubernetesClusterDomain` | | `"cluster.local"` |
35-
| `metricsService.ports` | | `[{"name": "https", "port": 8443, "protocol": "TCP", "targetPort": "https"}]` |
26+
| `metricsService.ports` | | `[{"name": "https", "port": 8443, "protocol": "TCP", "targetPort": 8443}]` |
3627
| `metricsService.type` | | `"ClusterIP"` |
3728
| `env` | | `[]` |
3829
| `proxy.enabled` | | `false` |

‎chart/validator-plugin-maas/templates/deployment.yaml

-12
Original file line numberDiff line numberDiff line change
@@ -39,18 +39,6 @@ spec:
3939
runAsNonRoot: true
4040
{{- end }}
4141
containers:
42-
- args: {{- toYaml .Values.controllerManager.kubeRbacProxy.args | nindent 8 }}
43-
env:
44-
- name: KUBERNETES_CLUSTER_DOMAIN
45-
value: {{ quote .Values.kubernetesClusterDomain }}
46-
image: {{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag | default .Chart.AppVersion }}
47-
name: kube-rbac-proxy
48-
ports:
49-
- containerPort: 8443
50-
name: https
51-
protocol: TCP
52-
resources: {{- toYaml .Values.controllerManager.kubeRbacProxy.resources | nindent 10 }}
53-
securityContext: {{- toYaml .Values.controllerManager.kubeRbacProxy.containerSecurityContext | nindent 10 }}
5442
- args: {{- toYaml .Values.controllerManager.manager.args | nindent 8 }}
5543
command:
5644
- /manager

‎chart/validator-plugin-maas/templates/proxy-rbac.yaml renamed to ‎chart/validator-plugin-maas/templates/metrics-auth-rbac.yaml

+3-5
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
apiVersion: rbac.authorization.k8s.io/v1
22
kind: ClusterRole
33
metadata:
4-
name: {{ include "chart.fullname" . }}-proxy-role
4+
name: {{ include "chart.fullname" . }}-metrics-auth-role
55
labels:
6-
app.kubernetes.io/component: kube-rbac-proxy
76
app.kubernetes.io/created-by: validator-plugin-maas
87
app.kubernetes.io/part-of: validator-plugin-maas
98
{{- include "chart.labels" . | nindent 4 }}
@@ -24,16 +23,15 @@ rules:
2423
apiVersion: rbac.authorization.k8s.io/v1
2524
kind: ClusterRoleBinding
2625
metadata:
27-
name: {{ include "chart.fullname" . }}-proxy-rolebinding
26+
name: {{ include "chart.fullname" . }}-metrics-auth-rolebinding
2827
labels:
29-
app.kubernetes.io/component: kube-rbac-proxy
3028
app.kubernetes.io/created-by: validator-plugin-maas
3129
app.kubernetes.io/part-of: validator-plugin-maas
3230
{{- include "chart.labels" . | nindent 4 }}
3331
roleRef:
3432
apiGroup: rbac.authorization.k8s.io
3533
kind: ClusterRole
36-
name: '{{ include "chart.fullname" . }}-proxy-role'
34+
name: '{{ include "chart.fullname" . }}-metrics-auth-role'
3735
subjects:
3836
- kind: ServiceAccount
3937
name: '{{ include "chart.fullname" . }}-controller-manager'

‎chart/validator-plugin-maas/templates/metrics-reader-rbac.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ kind: ClusterRole
33
metadata:
44
name: {{ include "chart.fullname" . }}-metrics-reader
55
labels:
6-
app.kubernetes.io/component: kube-rbac-proxy
76
app.kubernetes.io/created-by: validator-plugin-maas
87
app.kubernetes.io/part-of: validator-plugin-maas
98
{{- include "chart.labels" . | nindent 4 }}

‎chart/validator-plugin-maas/templates/metrics-service.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ kind: Service
33
metadata:
44
name: {{ include "chart.fullname" . }}-controller-manager-metrics-service
55
labels:
6-
app.kubernetes.io/component: kube-rbac-proxy
76
app.kubernetes.io/created-by: validator-plugin-maas
87
app.kubernetes.io/part-of: validator-plugin-maas
98
control-plane: controller-manager

‎chart/validator-plugin-maas/values.yaml

+2-22
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,7 @@
11
controllerManager:
2-
kubeRbacProxy:
3-
args:
4-
- --secure-listen-address=0.0.0.0:8443
5-
- --upstream=http://127.0.0.1:8080/
6-
- --logtostderr=true
7-
- --v=0
8-
containerSecurityContext:
9-
allowPrivilegeEscalation: false
10-
capabilities:
11-
drop:
12-
- ALL
13-
image:
14-
repository: gcr.io/kubebuilder/kube-rbac-proxy
15-
tag: v0.16.0
16-
resources:
17-
limits:
18-
cpu: 500m
19-
memory: 128Mi
20-
requests:
21-
cpu: 5m
22-
memory: 64Mi
232
manager:
243
args:
4+
- --metrics-bind-address=:8443
255
- --health-probe-bind-address=:8081
266
- --leader-elect
277
containerSecurityContext:
@@ -48,7 +28,7 @@ metricsService:
4828
- name: https
4929
port: 8443
5030
protocol: TCP
51-
targetPort: https
31+
targetPort: 8443
5232
type: ClusterIP
5333

5434
# Optional environment variable configuration

‎cmd/main.go

+58
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ limitations under the License.
1818
package main
1919

2020
import (
21+
"crypto/tls"
2122
"flag"
2223
"os"
2324

@@ -31,6 +32,8 @@ import (
3132
ctrl "sigs.k8s.io/controller-runtime"
3233
"sigs.k8s.io/controller-runtime/pkg/healthz"
3334
"sigs.k8s.io/controller-runtime/pkg/log/zap"
35+
"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
36+
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
3437

3538
validationv1alpha1 "github.com/validator-labs/validator-plugin-maas/api/v1alpha1"
3639
"github.com/validator-labs/validator-plugin-maas/internal/controller"
@@ -51,12 +54,23 @@ func init() {
5154
}
5255

5356
func main() {
57+
var metricsAddr string
5458
var enableLeaderElection bool
5559
var probeAddr string
60+
var secureMetrics bool
61+
var enableHTTP2 bool
62+
var tlsOpts []func(*tls.Config)
5663
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
5764
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
5865
"Enable leader election for controller manager. "+
5966
"Enabling this will ensure there is only one active controller manager.")
67+
flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
68+
"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
69+
flag.BoolVar(&secureMetrics, "metrics-secure", true,
70+
"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
71+
flag.BoolVar(&enableHTTP2, "enable-http2", false,
72+
"If set, HTTP/2 will be enabled for the metrics and webhook servers")
73+
6074
opts := zap.Options{
6175
Development: true,
6276
}
@@ -65,8 +79,52 @@ func main() {
6579

6680
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
6781

82+
// if the enable-http2 flag is false (the default), http/2 should be disabled
83+
// due to its vulnerabilities. More specifically, disabling http/2 will
84+
// prevent from being vulnerable to the HTTP/2 Stream Cancellation and
85+
// Rapid Reset CVEs. For more information see:
86+
// - https://github.com/advisories/GHSA-qppj-fm5r-hxr3
87+
// - https://github.com/advisories/GHSA-4374-p667-p6c8
88+
disableHTTP2 := func(c *tls.Config) {
89+
setupLog.Info("disabling http/2")
90+
c.NextProtos = []string{"http/1.1"}
91+
}
92+
93+
if !enableHTTP2 {
94+
tlsOpts = append(tlsOpts, disableHTTP2)
95+
}
96+
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
97+
// More info:
98+
// - https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/server
99+
// - https://book.kubebuilder.io/reference/metrics.html
100+
metricsServerOptions := metricsserver.Options{
101+
BindAddress: metricsAddr,
102+
SecureServing: secureMetrics,
103+
TLSOpts: tlsOpts,
104+
}
105+
106+
if secureMetrics {
107+
// FilterProvider is used to protect the metrics endpoint with authn/authz.
108+
// These configurations ensure that only authorized users and service accounts
109+
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
110+
// https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization
111+
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
112+
113+
// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
114+
// generate self-signed certificates for the metrics server. While convenient for development and testing,
115+
// this setup is not recommended for production.
116+
117+
// TODO(user): If cert-manager is enabled in config/default/kustomization.yaml,
118+
// you can uncomment the following lines to use the certificate managed by cert-manager.
119+
// metricsServerOptions.CertDir = "/tmp/k8s-metrics-server/metrics-certs"
120+
// metricsServerOptions.CertName = "tls.crt"
121+
// metricsServerOptions.KeyName = "tls.key"
122+
123+
}
124+
68125
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
69126
Scheme: scheme,
127+
Metrics: metricsServerOptions,
70128
HealthProbeBindAddress: probeAddr,
71129
LeaderElection: enableLeaderElection,
72130
LeaderElectionID: "ecaf1259.spectrocloud.labs",

0 commit comments

Comments
 (0)