✨ Remove kube-rbac-proxy and use controller run-time provided WithAuthenticationAndAuthorization filter instead #2102

kashifest · 2024-12-05T12:10:27Z

❗ Following resources have been removed as part of this PR:

ClusterRole: baremetal-operator-metrics-reader
ClusterRole: baremetal-operator-proxy-role
ClusterRoleBinding: baremetal-operator-proxy-rolebinding
Service: baremetal-operator-controller-manager-metrics-service

Short description: kube-rbac-proxy was historically used to protect the metrics endpoint. However, its usage has been discontinued in Kubebuilder. The default scaffold now leverages the WithAuthenticationAndAuthorization feature provided by Controller-Runtime. This change is trigerred from the fact that the image gcr.io/kubebuilder/kube-rbac-proxy is deprecated and will become unavailable sometime from early 2025.

Fixes: #2091

…er instead Short description: kube-rbac-proxy was historically used to protect the metrics endpoint. However, its usage has been discontinued in Kubebuilder. The default scaffold now leverages the WithAuthenticationAndAuthorization feature provided by Controller-Runtime. This change is trigerred from the fact that the image gcr.io/kubebuilder/kube-rbac-proxy is deprecated and will become unavailable sometime from early 2025. Fixes: metal3-io#2091 Signed-off-by: Kashif Khan <kashif.khan@est.tech>

kashifest · 2024-12-05T12:33:11Z

/cc @zaneb @honza @lentzi90 @Rozzii

elfosardo · 2024-12-06T15:35:36Z

/lgtm

lentzi90

/approve

For the release notes, I think we should document clearly the resources that have been deleted. Some users may use systems that automatically prune but others may need to do it manually. The resources are:

ClusterRole: baremetal-operator-metrics-reader
ClusterRole: baremetal-operator-proxy-role
ClusterRoleBinding: baremetal-operator-proxy-rolebinding
Service: baremetal-operator-controller-manager-metrics-service

/hold
Please add this to the description so it is picked up in the release notes. I wonder if we should also mark it as ✨

metal3-io-bot · 2024-12-09T10:27:15Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lentzi90

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [lentzi90]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kashifest · 2024-12-09T10:30:24Z

/hold Please add this to the description so it is picked up in the release notes. I wonder if we should also mark it as ✨

Done

tuminoid · 2024-12-09T10:51:39Z

Unhold?

lentzi90 · 2024-12-09T11:09:31Z

/hold cancel

tuminoid · 2024-12-09T12:02:31Z

/cherry-pick release-0.8

metal3-io-bot · 2024-12-09T12:03:14Z

@tuminoid: #2102 failed to apply on top of branch "release-0.8":

Applying: Remove kube-rbac-proxy and use controller run-time provided auth filter instead
Using index info to reconstruct a base tree...
M	config/base/kustomization.yaml
M	config/render/capm3.yaml
M	go.mod
M	go.sum
M	main.go
Falling back to patching base and 3-way merge...
Auto-merging main.go
Auto-merging go.sum
CONFLICT (content): Merge conflict in go.sum
Auto-merging go.mod
CONFLICT (content): Merge conflict in go.mod
Auto-merging config/render/capm3.yaml
Removing config/base/rbac/auth_proxy_service.yaml
Removing config/base/rbac/auth_proxy_role_binding.yaml
Removing config/base/rbac/auth_proxy_role.yaml
Removing config/base/rbac/auth_proxy_client_clusterrole.yaml
Removing config/base/manager_auth_proxy_patch.yaml
Auto-merging config/base/kustomization.yaml
CONFLICT (content): Merge conflict in config/base/kustomization.yaml
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 Remove kube-rbac-proxy and use controller run-time provided auth filter instead

In response to this:

/cherry-pick release-0.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

tuminoid · 2024-12-09T12:03:59Z

@kashifest shall we do manual cherry-pick? 0.8 support extends beyond rbac-proxy deprecation period.

kashifest · 2024-12-09T15:39:35Z

@kashifest shall we do manual cherry-pick? 0.8 support extends beyond rbac-proxy deprecation period.

Good point, I will push it.

❗ Following resources have been removed as part of this PR: - ClusterRole: baremetal-operator-metrics-reader - ClusterRole: baremetal-operator-proxy-role - ClusterRoleBinding: baremetal-operator-proxy-rolebinding - Service: baremetal-operator-controller-manager-metrics-service Short description: kube-rbac-proxy was historically used to protect the metrics endpoint. However, its usage has been discontinued in Kubebuilder. The default scaffold now leverages the WithAuthenticationAndAuthorization feature provided by Controller-Runtime. This change is trigerred from the fact that the image gcr.io/kubebuilder/kube-rbac-proxy is deprecated and will become unavailable sometime from early 2025. Signed-off-by: Kashif Khan <kashif.khan@est.tech>

BMO manifests have removed kub-rbac-proxy due to deprecation. This PR adapts the e2e tests accordoingly. For reference: - metal3-io/baremetal-operator#2102 - metal3-io/baremetal-operator#2115 Signed-off-by: Kashif Khan <kashif.khan@est.tech>

camilamacedo86 · 2024-12-10T20:48:22Z

config/render/capm3.yaml

-        name: kube-rbac-proxy
-        ports:
-        - containerPort: 8443
-          name: https


Where are the RBAC roles now required for controller runtime?
I think you forgot those.

Oh! @kashifest we need to test this and probably add some new RBAC

Indeed! I have put a PR for that #2116, I haven't tested them yet but those seem to me the missing RBACs

metal3-io#2102 has introduced controller-runtime's WithAuthenticationAndAuthorization filter which also requires extra RBAC roles and role bindings for metrics authentication and authorization. This PR adds those. Signed-off-by: Kashif Khan <kashif.khan@est.tech>

metal3-io-bot requested review from dtantsur and mquhuy December 5, 2024 12:10

metal3-io-bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Dec 5, 2024

kashifest changed the title ~~🌱 Remove kube-rbac-proxy and use controller run-time provided auth WithAuthenticationAndAuthorization instead~~ 🌱 Remove kube-rbac-proxy and use controller run-time provided WithAuthenticationAndAuthorization filter instead Dec 5, 2024

metal3-io-bot requested review from honza, lentzi90, Rozzii and zaneb December 5, 2024 12:33

metal3-io-bot added the lgtm Indicates that a PR is ready to be merged. label Dec 6, 2024

lentzi90 reviewed Dec 9, 2024

View reviewed changes

metal3-io-bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 9, 2024

metal3-io-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 9, 2024

kashifest changed the title ~~🌱 Remove kube-rbac-proxy and use controller run-time provided WithAuthenticationAndAuthorization filter instead~~ ✨ Remove kube-rbac-proxy and use controller run-time provided WithAuthenticationAndAuthorization filter instead Dec 9, 2024

metal3-io-bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 9, 2024

metal3-io-bot merged commit a1a9cef into metal3-io:main Dec 9, 2024
43 of 45 checks passed

metal3-io-bot deleted the kashif/remove-kube-rbac-proxy branch December 9, 2024 11:11

metal3-io-bot added this to the BMO - v0.9 milestone Dec 9, 2024

kashifest mentioned this pull request Dec 10, 2024

✨ Remove kube-rbac-proxy and use controller run-time provided WithAuthenticationAndAuthorization filter instead #2115

Merged

kashifest mentioned this pull request Dec 10, 2024

🌱 Adapt e2e test after removal of kube-rbac-proxy in BMO manifest metal3-io/cluster-api-provider-metal3#2139

Merged

camilamacedo86 reviewed Dec 10, 2024

View reviewed changes

kashifest mentioned this pull request Dec 11, 2024

✨ Add RBAC files for metrics authentication and authorization #2116

Merged

kashifest mentioned this pull request Dec 20, 2024

✨ Add RBAC files for metrics authentication and authorization #2145

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Remove kube-rbac-proxy and use controller run-time provided WithAuthenticationAndAuthorization filter instead #2102

✨ Remove kube-rbac-proxy and use controller run-time provided WithAuthenticationAndAuthorization filter instead #2102

kashifest commented Dec 5, 2024 •

edited

Loading

kashifest commented Dec 5, 2024

elfosardo commented Dec 6, 2024

lentzi90 left a comment

metal3-io-bot commented Dec 9, 2024

kashifest commented Dec 9, 2024

tuminoid commented Dec 9, 2024

lentzi90 commented Dec 9, 2024

tuminoid commented Dec 9, 2024

metal3-io-bot commented Dec 9, 2024

tuminoid commented Dec 9, 2024

kashifest commented Dec 9, 2024

camilamacedo86 Dec 10, 2024

lentzi90 Dec 11, 2024

kashifest Dec 11, 2024

✨ Remove kube-rbac-proxy and use controller run-time provided WithAuthenticationAndAuthorization filter instead #2102

✨ Remove kube-rbac-proxy and use controller run-time provided WithAuthenticationAndAuthorization filter instead #2102

Conversation

kashifest commented Dec 5, 2024 • edited Loading

kashifest commented Dec 5, 2024

elfosardo commented Dec 6, 2024

lentzi90 left a comment

Choose a reason for hiding this comment

metal3-io-bot commented Dec 9, 2024

kashifest commented Dec 9, 2024

tuminoid commented Dec 9, 2024

lentzi90 commented Dec 9, 2024

tuminoid commented Dec 9, 2024

metal3-io-bot commented Dec 9, 2024

tuminoid commented Dec 9, 2024

kashifest commented Dec 9, 2024

camilamacedo86 Dec 10, 2024

Choose a reason for hiding this comment

lentzi90 Dec 11, 2024

Choose a reason for hiding this comment

kashifest Dec 11, 2024

Choose a reason for hiding this comment

kashifest commented Dec 5, 2024 •

edited

Loading