Conditionally Enable filters.WithAuthenticationAndAuthorization Only When secureMetrics is True

[camilamacedo86]

What do you want to happen?

In the default scaffold of main.go, the FilterProvider: filters.WithAuthenticationAndAuthorization is always enabled. However, this can lead to security issues as it requires a ServiceAccount token to always be provided, which should never be sent via HTTP.

Problem Statement:

By always enabling filters.WithAuthenticationAndAuthorization, users are forced to provide a ServiceAccount token, even in cases where secureMetrics is not set to true. This can lead to tokens being sent over insecure connections, which is not advisable.

Proposal:

The filters.WithAuthenticationAndAuthorization should only be enabled when secureMetrics is set to true. This will ensure that ServiceAccount tokens are only required and used when secure communication is enabled.
Update the implementation in the default scaffold of main.go to conditionally enable filters.WithAuthenticationAndAuthorization based on the value of secureMetrics.

References:

• PR #4003

Expected Behavior:

The filters.WithAuthenticationAndAuthorization should be conditional and only enabled when secureMetrics is true. This ensures that ServiceAccount tokens are only needed in a secure environment, preventing them from being sent over HTTP.

Proposed Solution:

Example Code Change:

Metrics: metricsserver.Options {
    BindAddress:   metricsAddr,
    SecureServing: secureMetrics,
    TLSOpts:       tlsOpts,
    FilterProvider: func() metricsserver.FilterProvider {
        if secureMetrics {
            return filters.WithAuthenticationAndAuthorization
        }
        return nil
    }(),
},

Extra Labels

No response

[camilamacedo86]

@sbueringer,

Thank you for raise this one.

[sbueringer]

I think I would prefer only setting a FilterProvider if secureMetrics is true (compared to setting one that returns nil).

But I think both works today with controller-runtime.

I would generally expect that if a FilterProvider is set it either returns an error or it returns a FilterProvider, not nil, nil

[alex-kattathra-johnson]

@sbueringer: Looks like the example code is setting the FilterProvider only if secureMetrics is true, the anonymous function returns a FilterProvider or nil based on that condition. I'd be interested in picking this up as a first issue! :)

[sbueringer]

Ups sorry. You're right!

[camilamacedo86]

Hi @sbueringer and @alex-kattathra-johnson

The example code is only to show where/what we need to do.
Anyway that does the achieve the expected result it is fine, it can either to be something like:

Metrics: metricsserver.Options {
    BindAddress:   metricsAddr,
    SecureServing: secureMetrics,
    TLSOpts:       tlsOpts,
    if secureMetrics {
         FilterProvider: func() metricsserver.FilterProvider {
            return filters.WithAuthenticationAndAuthorization
        }   
    },
},

I would either prefer something simple like above 👍

[sbueringer]

All good, I was just misreading the anonymous func :)