📖 : Proposal : Discontinue Kube RBAC Proxy in Default Kubebuilder Scaffolding

[camilamacedo86]

Motivations

• use a NetworkPolicy instead of kube-rbac-proxy #1885
• kube-rbac-proxy warn about deprecation and future breaking changes #3524
• RFC: The kube-rbac-proxy is too opinionated to be opt-out. #3482
• Migrate away from google.com gcp project kubebuilder #3230

c/c @ibihim

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[camilamacedo86]

/hold

To allow approvals and more people review this one

[joejulian]

link to where this is documented?

[camilamacedo86]

Hi @joejulian,

Thank you for your review and time.
Could you please let us know what documentation are you looking for here?
What exactly clarifications do you need in the OpenQuestion answered.

[joejulian]

Someone who was previously relying on kube-rbac-proxy wants to now follow the new recommended method of using cert-manager and the new mtls feature (if I'm understanding this correctly), where do they find the documentation for that? Could we link that here?

[camilamacedo86]

That is the proposal for change
We are proposing it all get done in phases
So, the first phase does not use cert-manager
See: #3853

Then, in a follow up of this PR we need to add a config in the kustomize
that will allow we patch the serviceMonitor and certs such as we do now for webhooks
See that we have in the config/default/ a patch for cert-manager + webhooks:
See

kubebuilder/docs/book/src/component-config-tutorial/testdata/project/config/default/kustomization.yaml

Lines 51 to 149 in bd0876b

	# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
	# Uncomment the following replacements to add the cert-manager CA injection annotations
	#replacements:
	# - source: # Add cert-manager annotation to ValidatingWebhookConfiguration, MutatingWebhookConfiguration and CRDs
	# kind: Certificate
	# group: cert-manager.io
	# version: v1
	# name: serving-cert # this name should match the one in certificate.yaml
	# fieldPath: .metadata.namespace # namespace of the certificate CR
	# targets:
	# - select:
	# kind: ValidatingWebhookConfiguration
	# fieldPaths:
	# - .metadata.annotations.[cert-manager.io/inject-ca-from]
	# options:
	# delimiter: '/'
	# index: 0
	# create: true
	# - select:
	# kind: MutatingWebhookConfiguration
	# fieldPaths:
	# - .metadata.annotations.[cert-manager.io/inject-ca-from]
	# options:
	# delimiter: '/'
	# index: 0
	# create: true
	# - select:
	# kind: CustomResourceDefinition
	# fieldPaths:
	# - .metadata.annotations.[cert-manager.io/inject-ca-from]
	# options:
	# delimiter: '/'
	# index: 0
	# create: true
	# - source:
	# kind: Certificate
	# group: cert-manager.io
	# version: v1
	# name: serving-cert # this name should match the one in certificate.yaml
	# fieldPath: .metadata.name
	# targets:
	# - select:
	# kind: ValidatingWebhookConfiguration
	# fieldPaths:
	# - .metadata.annotations.[cert-manager.io/inject-ca-from]
	# options:
	# delimiter: '/'
	# index: 1
	# create: true
	# - select:
	# kind: MutatingWebhookConfiguration
	# fieldPaths:
	# - .metadata.annotations.[cert-manager.io/inject-ca-from]
	# options:
	# delimiter: '/'
	# index: 1
	# create: true
	# - select:
	# kind: CustomResourceDefinition
	# fieldPaths:
	# - .metadata.annotations.[cert-manager.io/inject-ca-from]
	# options:
	# delimiter: '/'
	# index: 1
	# create: true
	# - source: # Add cert-manager annotation to the webhook Service
	# kind: Service
	# version: v1
	# name: webhook-service
	# fieldPath: .metadata.name # namespace of the service
	# targets:
	# - select:
	# kind: Certificate
	# group: cert-manager.io
	# version: v1
	# fieldPaths:
	# - .spec.dnsNames.0
	# - .spec.dnsNames.1
	# options:
	# delimiter: '.'
	# index: 0
	# create: true
	# - source:
	# kind: Service
	# version: v1
	# name: webhook-service
	# fieldPath: .metadata.namespace # namespace of the service
	# targets:
	# - select:
	# kind: Certificate
	# group: cert-manager.io
	# version: v1
	# fieldPaths:
	# - .spec.dnsNames.0
	# - .spec.dnsNames.1
	# options:
	# delimiter: '.'
	# index: 1
	# create: true

and https://github.com/kubernetes-sigs/kubebuilder/blob/master/testdata/project-v4/config/default/manager_webhook_patch.yaml

In the follow up we will need to do something similar
We will need to have something like

# [METRICS WITH HTTPS] To enable the ServiceMonitor using HTTPS uncomment the following line
# Note that for that works you also need ensure that you enable cert-manager in your project
- path: metrics_https_patch.yaml

That should patch https://github.com/kubernetes-sigs/kubebuilder/pull/3853/files#diff-8545904ae77cfcef7da403b4fe25b822439217abe9307d5d31b29690140d0fc6

As part of the task we will need also to update the docs to clarify how that works and etc.

[camilamacedo86]

Hi @joejulian

It was also added in the proposal.
See that we are adding examples either how the YAML would end up.

Thank you for raise it out.

[everettraven]

This all LGTM. Thanks for putting this together @camilamacedo86 !

[camilamacedo86]

Hi @joejulian

Have we your LGTM as well now that all suggestions are applied?
Or have you any objection of the proposal itself?

[joejulian]

Yes, thanks, lgtm fwiw.

[varshaprasad96]

I'm yet to get familiar with K8s network policies and go over the changes with controller-runtime. However, on reading the proposal, the proposed option seems better than the alternatives and the transition plan seems good.

Thanks @camilamacedo86!
/lgtm
/approve

[varshaprasad96]

Can we also have the link to the issue that tracks the inclusion of kube-rbac-proxy to k8s-apimachinery umbrella ?

[camilamacedo86]

Done

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: camilamacedo86, everettraven, joejulian, varshaprasad96

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [camilamacedo86,varshaprasad96]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[camilamacedo86]

It seems that we have enough approvals and lgtms and no objections at all to the proposal.

It was either communicate in the channels and mailing list.
Sadly, as you can see we either have not so many options since we cannot keep maintained and ensure that build and promotion of kube-rbac-proxy images

Therefore, it seems good enough to fly now.

PS.: We can create many follow up PR to change/improve and etc this one as we see fit as well.

/hold cancel

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.