Skip to content

Commit fe7db97

Browse files
porridgeporridge
authored
ROX-22289: drop kube-rbac-proxy sidecar (#9808)
1 parent 2e70b08 commit fe7db97

10 files changed

Lines changed: 77 additions & 68 deletions

File tree

‎go.mod‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,13 +173,15 @@ require (
173173
github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c // indirect
174174
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
175175
github.com/andybalholm/brotli v1.0.4 // indirect
176+
github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df // indirect
176177
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
177178
github.com/beevik/etree v1.2.0 // indirect
178179
github.com/beorn7/perks v1.0.1 // indirect
179180
github.com/bits-and-blooms/bitset v1.12.0 // indirect
180181
github.com/blang/semver v3.5.1+incompatible // indirect
181182
github.com/blang/semver/v4 v4.0.0 // indirect
182183
github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 // indirect
184+
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
183185
github.com/cespare/xxhash/v2 v2.2.0 // indirect
184186
github.com/chai2010/gettext-go v1.0.2 // indirect
185187
github.com/cloudflare/circl v1.3.7 // indirect
@@ -247,6 +249,7 @@ require (
247249
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
248250
github.com/golang/snappy v0.0.4 // indirect
249251
github.com/google/btree v1.1.2 // indirect
252+
github.com/google/cel-go v0.17.7 // indirect
250253
github.com/google/go-querystring v1.1.0 // indirect
251254
github.com/google/gofuzz v1.2.0 // indirect
252255
github.com/google/pprof v0.0.0-20231023181126-ff6d637d2a7b // indirect
@@ -257,6 +260,7 @@ require (
257260
github.com/gorilla/websocket v1.5.0 // indirect
258261
github.com/gosuri/uitable v0.0.4 // indirect
259262
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
263+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.0 // indirect
260264
github.com/hashicorp/errwrap v1.1.0 // indirect
261265
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
262266
github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
@@ -354,6 +358,7 @@ require (
354358
github.com/stackrox/dotnet-scraper v0.0.0-20201023051640-72ef543323dd // indirect
355359
github.com/stackrox/istio-cves v0.0.0-20221007013142-0bde9b541ec8 // indirect
356360
github.com/stackrox/k8s-cves v0.0.0-20220818200547-7d0d1420c58d // indirect
361+
github.com/stoewer/go-strcase v1.2.0 // indirect
357362
github.com/stretchr/objx v0.5.0 // indirect
358363
github.com/subosito/gotenv v1.6.0 // indirect
359364
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
@@ -380,8 +385,12 @@ require (
380385
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1 // indirect
381386
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 // indirect
382387
go.opentelemetry.io/otel v1.22.0 // indirect
388+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 // indirect
389+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0 // indirect
383390
go.opentelemetry.io/otel/metric v1.22.0 // indirect
391+
go.opentelemetry.io/otel/sdk v1.21.0 // indirect
384392
go.opentelemetry.io/otel/trace v1.22.0 // indirect
393+
go.opentelemetry.io/proto/otlp v1.0.0 // indirect
385394
go.starlark.net v0.0.0-20230612165344-9532f5667272 // indirect
386395
go.uber.org/multierr v1.11.0 // indirect
387396
golang.org/x/mod v0.14.0 // indirect
@@ -411,6 +420,7 @@ require (
411420
modernc.org/token v1.0.1 // indirect
412421
nhooyr.io/websocket v1.8.10 // indirect
413422
oras.land/oras-go v1.2.4 // indirect
423+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.28.0 // indirect
414424
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
415425
sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 // indirect
416426
sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 // indirect

‎go.sum‎

Lines changed: 19 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎operator/bundle/manifests/rhacs-operator-manager-config_v1_configmap.yaml‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎operator/bundle/manifests/rhacs-operator.clusterserviceversion.yaml‎

Lines changed: 4 additions & 20 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎operator/bundle_helpers/patch-csv.py‎

Lines changed: 4 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,6 @@ def __str__(self):
2323
return f"{self.x}.{self.y}.{self.z}"
2424

2525

26-
def rbac_proxy_replace(updated_img):
27-
def update_rbac_proxy_img(img):
28-
"""
29-
Updates the reference to the kube-rbac-proxy image to match the OpenShift one.
30-
"""
31-
if not isinstance(img, str) or not img.startswith('gcr.io/kubebuilder/kube-rbac-proxy:'):
32-
return None
33-
return updated_img
34-
35-
return update_rbac_proxy_img
36-
37-
3826
def related_image_passthrough(val):
3927
"""
4028
Searches for environment variable definitions of the form RELATED_IMAGE_* and replaces them
@@ -61,8 +49,7 @@ def must_replace_suffix(str, suffix, replacement):
6149
return splits[0] + replacement
6250

6351

64-
def patch_csv(csv_doc, version, operator_image, first_version, no_related_images, extra_supported_arches,
65-
rbac_proxy_replacement):
52+
def patch_csv(csv_doc, version, operator_image, first_version, no_related_images, extra_supported_arches):
6653
csv_doc['metadata']['annotations']['createdAt'] = datetime.now(timezone.utc).isoformat()
6754

6855
placeholder_image = csv_doc['metadata']['annotations']['containerImage']
@@ -76,9 +63,6 @@ def patch_csv(csv_doc, version, operator_image, first_version, no_related_images
7663
if not no_related_images:
7764
rewrite(csv_doc, related_image_passthrough)
7865

79-
if rbac_proxy_replacement:
80-
rewrite(csv_doc, rbac_proxy_replace(rbac_proxy_replacement))
81-
8266
previous_y_stream = get_previous_y_stream(version)
8367

8468
# An olm.skipRange doesn't hurt if it references non-existing versions.
@@ -169,8 +153,8 @@ def parse_args():
169153
help='Which operator image to use in the patched CSV')
170154
parser.add_argument("--no-related-images", action='store_true',
171155
help='Disable passthrough of related images')
172-
parser.add_argument("--replace-rbac-proxy", required=False, metavar='replacement-image:tag',
173-
help='Replacement directives for the RBAC proxy image')
156+
# TODO(ROX-22395): remove this option once downstream scripts don't pass the argument.
157+
parser.add_argument("--replace-rbac-proxy", help='This option is deprecated and ignored.')
174158
parser.add_argument("--add-supported-arch", action='append', required=False,
175159
help='Enable specified operator architecture via CSV labels (may be passed multiple times)',
176160
default=[])
@@ -187,8 +171,7 @@ def main():
187171
version=args.use_version,
188172
first_version=args.first_version,
189173
no_related_images=args.no_related_images,
190-
extra_supported_arches=args.add_supported_arch,
191-
rbac_proxy_replacement=args.replace_rbac_proxy)
174+
extra_supported_arches=args.add_supported_arch)
192175
print(yaml.safe_dump(doc))
193176

194177

‎operator/config/default/kustomization.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@ patchesStrategicMerge:
2727
# Protect the /metrics endpoint by putting it behind auth.
2828
# If you want your controller-manager to expose the /metrics
2929
# endpoint w/o any authn/z, please comment the following line.
30-
- manager_auth_proxy_patch.yaml
30+
# The authentication is now done in-process, by controller-runtime.
31+
#- manager_auth_proxy_patch.yaml
3132

3233
# Mount the controller config file for loading manager configurations
3334
# through a ComponentConfig type

‎operator/config/manager/controller_manager_config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ kind: ControllerManagerConfig
33
health:
44
healthProbeBindAddress: :8081
55
metrics:
6-
bindAddress: 127.0.0.1:8080
6+
bindAddress: 0.0.0.0:8443
77
webhook:
88
port: 9443
99
leaderElection:

‎operator/config/manager/manager.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ spec:
3232
runAsNonRoot: true
3333
containers:
3434
- args:
35+
- "--health-probe-bind-address=:8081"
36+
- "--metrics-bind-address=0.0.0.0:8443"
3537
- --leader-elect
3638
env:
3739
- name: RELATED_IMAGE_MAIN
@@ -52,6 +54,10 @@ spec:
5254
name: manager
5355
securityContext:
5456
allowPrivilegeEscalation: false
57+
ports:
58+
- containerPort: 8443
59+
protocol: TCP
60+
name: https
5561
livenessProbe:
5662
httpGet:
5763
path: /healthz

‎operator/config/rbac/kustomization.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ resources:
1212
# Comment the following 4 lines if you want to disable
1313
# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
1414
# which protects your /metrics endpoint.
15+
# The authentication is now done by controller-runtime in-process,
16+
# so these resources are still useful even though we do not use the proxy sidecar.
1517
- auth_proxy_service.yaml
1618
- auth_proxy_role.yaml
1719
- auth_proxy_role_binding.yaml

0 commit comments

Comments
 (0)