Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

⚠ Introduce Metrics Options struct & secure metrics serving #2407

Merged
merged 1 commit into from
Aug 11, 2023

Conversation

sbueringer
Copy link
Member

@sbueringer sbueringer commented Jul 15, 2023

This PR introduces metrics options on the manager options. Via the new metrics options it will now be possible to serve metrics via tls and to use authentication and authorization.

  • Metrics.FilterProvider allows to provide a metrics filter.
    • filters.WithAuthenticationAndAuthorization is a builtin filter that implements authentication and authorization
  • Metrics.SecureServing enables serving metrics on https
    • This is necessary for the above filter because tokens for authentication should not be sent via http
  • Metrics.ExtraHandlers makes it possible to specify the extra handlers directly on the options. manager.AddMetricsExtraHandler has been removed.

Fixes #2073

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 15, 2023
@k8s-ci-robot k8s-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jul 15, 2023
@sbueringer sbueringer changed the title ⚠ Implement secure metrics serving [WIP] ⚠ Implement secure metrics serving Jul 15, 2023
@k8s-ci-robot k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 15, 2023
@sbueringer
Copy link
Member Author

sbueringer commented Jul 15, 2023

@alvaroaleman @vincepri
I think this should be ready for a first round of review & discussion.

After that I'll add more documentation and add / fix unit tests.

pkg/manager/internal.go Outdated Show resolved Hide resolved
pkg/manager/manager.go Outdated Show resolved Hide resolved
@sbueringer sbueringer changed the title [WIP] ⚠ Implement secure metrics serving [WIP] ✨ Implement secure metrics serving Jul 17, 2023
@k8s-ci-robot k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jul 17, 2023
@sbueringer sbueringer force-pushed the pr-auth-metrics branch 2 times, most recently from 1504d8f to 66ae79b Compare July 17, 2023 20:20
@sbueringer sbueringer changed the title [WIP] ✨ Implement secure metrics serving ✨ Implement secure metrics serving Jul 17, 2023
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 17, 2023
@sbueringer
Copy link
Member Author

@alvaroaleman Thx for the review. Changed the defaulting behavior and added test coverage

@sbueringer
Copy link
Member Author

@vincepri PTAL when you have some time :)

@sbueringer
Copy link
Member Author

Refactored the implementation to avoid introducing a dependency to k8s.io/apiserver for folks who are not using the authentication/authorization

pkg/manager/internal.go Outdated Show resolved Hide resolved
@sbueringer sbueringer force-pushed the pr-auth-metrics branch 3 times, most recently from 4b2e71f to 4aa927f Compare July 24, 2023 05:55
@sbueringer sbueringer changed the title ✨ Implement secure metrics serving ⚠ Implement secure metrics serving Jul 24, 2023
pkg/metrics/filters/filters.go Outdated Show resolved Hide resolved
pkg/metrics/listener.go Outdated Show resolved Hide resolved
pkg/manager/manager.go Outdated Show resolved Hide resolved
@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 25, 2023
lleshchi added a commit to lleshchi/hive that referenced this pull request Jan 27, 2024
Fix breaking changes from upgrade of controller-runtime.

Breaking changes from:
https://github.com/kubernetes-sigs/controller-runtime/releases/tag/v0.16.0
- kubernetes-sigs/controller-runtime#2407
- kubernetes-sigs/controller-runtime#2416

HIVE-2254

Signed-off-by: Leah Leshchinsky <lleshchi@redhat.com>
lleshchi added a commit to lleshchi/hive that referenced this pull request Jan 27, 2024
Fix breaking changes from upgrade of controller-runtime.

Breaking changes from:
https://github.com/kubernetes-sigs/controller-runtime/releases/tag/v0.16.0
- kubernetes-sigs/controller-runtime#2407
- kubernetes-sigs/controller-runtime#2416

HIVE-2254

Signed-off-by: Leah Leshchinsky <lleshchi@redhat.com>
lleshchi added a commit to lleshchi/hive that referenced this pull request Jan 27, 2024
Fix breaking changes from upgrade of controller-runtime.

Breaking changes from:
https://github.com/kubernetes-sigs/controller-runtime/releases/tag/v0.16.0
- kubernetes-sigs/controller-runtime#2407
- kubernetes-sigs/controller-runtime#2416

HIVE-2254

Signed-off-by: Leah Leshchinsky <lleshchi@redhat.com>
lleshchi added a commit to lleshchi/hive that referenced this pull request Jan 27, 2024
Fix breaking changes from upgrade of controller-runtime.

Breaking changes from:
https://github.com/kubernetes-sigs/controller-runtime/releases/tag/v0.16.0
- kubernetes-sigs/controller-runtime#2407
- kubernetes-sigs/controller-runtime#2416

HIVE-2254

Signed-off-by: Leah Leshchinsky <lleshchi@redhat.com>
lleshchi added a commit to lleshchi/hive that referenced this pull request Feb 2, 2024
Fix breaking changes from upgrade of controller-runtime.

Breaking changes from:
https://github.com/kubernetes-sigs/controller-runtime/releases/tag/v0.16.0
- kubernetes-sigs/controller-runtime#2407
- kubernetes-sigs/controller-runtime#2416

HIVE-2254

Signed-off-by: Leah Leshchinsky <lleshchi@redhat.com>
lleshchi added a commit to lleshchi/hive that referenced this pull request Feb 2, 2024
Fix breaking changes from upgrade of controller-runtime.

Breaking changes from:
https://github.com/kubernetes-sigs/controller-runtime/releases/tag/v0.16.0
- kubernetes-sigs/controller-runtime#2407
- kubernetes-sigs/controller-runtime#2416

HIVE-2254

Signed-off-by: Leah Leshchinsky <lleshchi@redhat.com>
lleshchi added a commit to lleshchi/hive that referenced this pull request Feb 8, 2024
Fix breaking changes from upgrade of controller-runtime.

Breaking changes from:
https://github.com/kubernetes-sigs/controller-runtime/releases/tag/v0.16.0
- kubernetes-sigs/controller-runtime#2407
- kubernetes-sigs/controller-runtime#2416

HIVE-2254

Signed-off-by: Leah Leshchinsky <lleshchi@redhat.com>
alebedev87 added a commit to alebedev87/aws-load-balancer-operator that referenced this pull request Dec 11, 2024
- Bumped golang to 1.22:
    - Update go.mod
    - Update Dockerfiles
- Bumped k8s.io/* modules to 0.30.3 and OpenShift API to 20240812094746-86145edb40cf.
- Bumped controller-runtime to 0.18.5:
    - Manager's `Port` option removed, now using dedicated webhook server field (kubernetes-sigs/controller-runtime#2422).
    - Manager's `MetricsBindAddress` option  removed, now using dedicated metrics server field (kubernetes-sigs/controller-runtime#2407).
    - Cache's `Namespaces` option replaced by `DefaultNamespaces` (kubernetes-sigs/controller-runtime#2421).
- Regenerated CRD and bundle manifests using `make bundle` command.
- Bumped `kustomize` to v5 to fix a conflict caused by k8s.io bumps:
    - `kyaml` unable to use the bumped `github.com/google/gnostic-models/openapiv2` package.
alebedev87 added a commit to alebedev87/aws-load-balancer-operator that referenced this pull request Dec 11, 2024
- Bumped golang to 1.22:
    - Update go.mod
    - Update Dockerfiles
- Bumped k8s.io/* modules to 0.30.3 and OpenShift API to 20240812094746-86145edb40cf.
- Bumped controller-runtime to 0.18.5:
    - Manager's `Port` option removed, now using dedicated webhook server field (kubernetes-sigs/controller-runtime#2422).
    - Manager's `MetricsBindAddress` option  removed, now using dedicated metrics server field (kubernetes-sigs/controller-runtime#2407).
    - Cache's `Namespaces` option replaced by `DefaultNamespaces` (kubernetes-sigs/controller-runtime#2421).
- Regenerated CRD and bundle manifests using `make bundle` command.
- Bumped `kustomize` to v5 to fix a conflict caused by k8s.io bumps:
    - `kyaml` unable to use the bumped `github.com/google/gnostic-models/openapiv2` package.
- Removed `TypeMeta` from expected deployment object when it's compared to
  structured one retrieved from fake client (kubernetes-sigs/controller-runtime#2633).
alebedev87 added a commit to alebedev87/aws-load-balancer-operator that referenced this pull request Dec 16, 2024
- Bumped golang to 1.22:
    - Update go.mod
    - Update Dockerfiles
- Bumped k8s.io/* modules to 0.30.3 and OpenShift API to 20240812094746-86145edb40cf.
- Bumped controller-runtime to 0.18.5:
    - Manager's `Port` option removed, now using dedicated webhook server field (kubernetes-sigs/controller-runtime#2422).
    - Manager's `MetricsBindAddress` option  removed, now using dedicated metrics server field (kubernetes-sigs/controller-runtime#2407).
    - Cache's `Namespaces` option replaced by `DefaultNamespaces` (kubernetes-sigs/controller-runtime#2421).
- Bumped aws-load-balancer-controller to f39ae43121c3 to use latest CRD scheme in e2e tests.
- Regenerated CRD and bundle manifests using `make bundle` command.
- Bumped `kustomize` to v5 to fix a conflict caused by k8s.io bumps:
    - `kyaml` unable to use the bumped `github.com/google/gnostic-models/openapiv2` package.
- Removed `TypeMeta` from expected deployment object when it's compared to
  structured one retrieved from fake client (kubernetes-sigs/controller-runtime#2633).
alebedev87 added a commit to alebedev87/aws-load-balancer-operator that referenced this pull request Dec 16, 2024
- Bumped golang to 1.22:
    - Update go.mod
    - Update Dockerfiles
- Bumped k8s.io/* modules to 0.30.3 and OpenShift API to 20240812094746-86145edb40cf.
- Bumped controller-runtime to 0.18.5:
    - Manager's `Port` option removed, now using dedicated webhook server field (kubernetes-sigs/controller-runtime#2422).
    - Manager's `MetricsBindAddress` option  removed, now using dedicated metrics server field (kubernetes-sigs/controller-runtime#2407).
    - Cache's `Namespaces` option replaced by `DefaultNamespaces` (kubernetes-sigs/controller-runtime#2421).
- Bumped aws-load-balancer-controller to f39ae43121c3 to use latest CRD scheme in e2e tests.
- Regenerated CRD and bundle manifests using `make bundle` command.
- Bumped `kustomize` to v5 to fix a conflict caused by k8s.io bumps:
    - `kyaml` unable to use the bumped `github.com/google/gnostic-models/openapiv2` package.
- Removed `TypeMeta` from expected deployment object when it's compared to
  structured one retrieved from fake client (kubernetes-sigs/controller-runtime#2633).
- Migrated infrastructure CRD retrieval to the new package `zz_generated.crd-manifests`:
    - Updated infrastructure CRD for unit tests using `make update-vendored-crds` command.
alebedev87 added a commit to alebedev87/aws-load-balancer-operator that referenced this pull request Dec 16, 2024
- Bumped golang to 1.22:
    - Update go.mod
    - Update Dockerfiles
- Bumped k8s.io/* modules to 0.30.3 and OpenShift API to 20240812094746-86145edb40cf.
- Bumped controller-runtime to 0.18.5:
    - Manager's `Port` option removed, now using dedicated webhook server field (kubernetes-sigs/controller-runtime#2422).
    - Manager's `MetricsBindAddress` option  removed, now using dedicated metrics server field (kubernetes-sigs/controller-runtime#2407).
    - Cache's `Namespaces` option replaced by `DefaultNamespaces` (kubernetes-sigs/controller-runtime#2421).
- Bumped aws-load-balancer-controller to f39ae43121c3 to use latest CRD scheme in e2e tests.
- Regenerated CRD and bundle manifests using `make bundle` command.
- Bumped `kustomize` to v5 to fix a conflict caused by k8s.io bumps:
    - `kyaml` unable to use the bumped `github.com/google/gnostic-models/openapiv2` package.
- Removed `TypeMeta` from expected deployment object when it's compared to
  structured one retrieved from fake client (kubernetes-sigs/controller-runtime#2633).
- Migrated infrastructure CRD retrieval to the new package `zz_generated.crd-manifests`:
    - Updated infrastructure CRD for unit tests using `make update-vendored-crds` command.
alebedev87 added a commit to alebedev87/aws-load-balancer-operator that referenced this pull request Dec 17, 2024
- Bumped golang to 1.22:
    - Update go.mod
    - Update Dockerfiles
- Bumped k8s.io/* modules to 0.30.3 and OpenShift API to 20240812094746-86145edb40cf.
- Bumped controller-runtime to 0.18.5:
    - Manager's `Port` option removed, now using dedicated webhook server field (kubernetes-sigs/controller-runtime#2422).
    - Manager's `MetricsBindAddress` option  removed, now using dedicated metrics server field (kubernetes-sigs/controller-runtime#2407).
    - Cache's `Namespaces` option replaced by `DefaultNamespaces` (kubernetes-sigs/controller-runtime#2421).
- Bumped aws-load-balancer-controller to f39ae43121c3 to use latest CRD scheme in e2e tests.
- Regenerated CRD and bundle manifests using `make bundle` command.
- Bumped `kustomize` to v5 to fix a conflict caused by k8s.io bumps:
    - `kyaml` unable to use the bumped `github.com/google/gnostic-models/openapiv2` package.
- Removed `TypeMeta` from expected deployment object when it's compared to
  structured one retrieved from fake client (kubernetes-sigs/controller-runtime#2633).
- Migrated infrastructure CRD retrieval to the new package `zz_generated.crd-manifests`:
    - Updated infrastructure CRD for unit tests using `make update-vendored-crds` command.
- Updated envtest setup to use the downstream index.
    - Infrastructure CRD uses CEL functions backported from newer k8s API.
    - Upstream `envtest` is not ready to use newer CEL function.
    - Bumped `setup-envtest` to be able to use `--index` flag.
alebedev87 added a commit to alebedev87/aws-load-balancer-operator that referenced this pull request Dec 17, 2024
- Bumped golang to 1.22:
    - Update go.mod
    - Update Dockerfiles
- Bumped k8s.io/* modules to 0.30.3 and OpenShift API to 20240812094746-86145edb40cf.
- Bumped controller-runtime to 0.18.5:
    - Manager's `Port` option removed, now using dedicated webhook server field (kubernetes-sigs/controller-runtime#2422).
    - Manager's `MetricsBindAddress` option  removed, now using dedicated metrics server field (kubernetes-sigs/controller-runtime#2407).
    - Cache's `Namespaces` option replaced by `DefaultNamespaces` (kubernetes-sigs/controller-runtime#2421).
- Bumped aws-load-balancer-controller to f39ae43121c3 to use latest CRD scheme in e2e tests.
- Regenerated CRD and bundle manifests using `make bundle` command.
- Bumped `kustomize` to v5 to fix a conflict caused by k8s.io bumps:
    - `kyaml` unable to use the bumped `github.com/google/gnostic-models/openapiv2` package.
- Removed `TypeMeta` from expected deployment object when it's compared to
  structured one retrieved from fake client (kubernetes-sigs/controller-runtime#2633).
- Migrated infrastructure CRD retrieval to the new package `zz_generated.crd-manifests`:
    - Updated infrastructure CRD for unit tests using `make update-vendored-crds` command.
- Updated envtest setup to use the downstream index.
    - Infrastructure CRD uses CEL functions backported from newer k8s API.
    - Upstream `envtest` is not ready to use newer CEL function.
    - Bumped `setup-envtest` to be able to use `--index` flag.
openshift-merge-bot bot pushed a commit to openshift/aws-load-balancer-operator that referenced this pull request Dec 18, 2024
#143)

- Bumped golang to 1.22:
    - Update go.mod
    - Update Dockerfiles
- Bumped k8s.io/* modules to 0.30.3 and OpenShift API to 20240812094746-86145edb40cf.
- Bumped controller-runtime to 0.18.5:
    - Manager's `Port` option removed, now using dedicated webhook server field (kubernetes-sigs/controller-runtime#2422).
    - Manager's `MetricsBindAddress` option  removed, now using dedicated metrics server field (kubernetes-sigs/controller-runtime#2407).
    - Cache's `Namespaces` option replaced by `DefaultNamespaces` (kubernetes-sigs/controller-runtime#2421).
- Bumped aws-load-balancer-controller to f39ae43121c3 to use latest CRD scheme in e2e tests.
- Regenerated CRD and bundle manifests using `make bundle` command.
- Bumped `kustomize` to v5 to fix a conflict caused by k8s.io bumps:
    - `kyaml` unable to use the bumped `github.com/google/gnostic-models/openapiv2` package.
- Removed `TypeMeta` from expected deployment object when it's compared to
  structured one retrieved from fake client (kubernetes-sigs/controller-runtime#2633).
- Migrated infrastructure CRD retrieval to the new package `zz_generated.crd-manifests`:
    - Updated infrastructure CRD for unit tests using `make update-vendored-crds` command.
- Updated envtest setup to use the downstream index.
    - Infrastructure CRD uses CEL functions backported from newer k8s API.
    - Upstream `envtest` is not ready to use newer CEL function.
    - Bumped `setup-envtest` to be able to use `--index` flag.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add authorization for metrics endpoint
4 participants