-
Notifications
You must be signed in to change notification settings - Fork 31
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Ruben Vargas <[email protected]>
- Loading branch information
1 parent
c2c2f7b
commit dce869d
Showing
18 changed files
with
228 additions
and
192 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,6 +6,7 @@ import ( | |
| "os" | ||
| "path/filepath" | ||
| "reflect" | ||
| "sigs.k8s.io/controller-runtime/pkg/metrics/filters" | ||
|
|
||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/apimachinery/pkg/runtime" | ||
|
|
@@ -65,6 +66,14 @@ func mergeOptionsFromFile(o manager.Options, cfg *configv1alpha1.ProjectConfig) | |
| o.Metrics.BindAddress = cfg.Metrics.BindAddress | ||
| } | ||
|
|
||
| o.Metrics.SecureServing = cfg.Metrics.Secure | ||
| if cfg.Metrics.Secure { | ||
| // FilterProvider is used to protect the metrics endpoint with authn/authz. | ||
| // These configurations ensure that only authorized users and service accounts | ||
| // can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info: | ||
| // https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization | ||
| o.Metrics.FilterProvider = filters.WithAuthenticationAndAuthorization | ||
| } | ||
| if o.HealthProbeBindAddress == "" && cfg.Health.HealthProbeBindAddress != "" { | ||
| o.HealthProbeBindAddress = cfg.Health.HealthProbeBindAddress | ||
| } | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,56 +1,166 @@ | ||
| bases: | ||
| resources: | ||
| - ../crd | ||
| - ../rbac | ||
| - ../manager | ||
| - ../webhook | ||
| - ../certmanager | ||
| # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'. | ||
| #- ../prometheus | ||
| - metrics_service.yaml | ||
|
|
||
| patchesStrategicMerge: | ||
| # Protect the /metrics endpoint by putting it behind auth. | ||
| # If you want your controller-manager to expose the /metrics | ||
| # endpoint w/o any authn/z, please comment the following line. | ||
| - manager_auth_proxy_patch.yaml | ||
|
|
||
| patches: | ||
| # Mount the controller config file for loading manager configurations | ||
| # through a ComponentConfig type | ||
| - manager_config_patch.yaml | ||
| - path: manager_config_patch.yaml | ||
|
|
||
| - path: manager_metrics_patch.yaml | ||
| target: | ||
| kind: Deployment | ||
|
|
||
|
|
||
| # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in | ||
| # crd/kustomization.yaml | ||
| - manager_webhook_patch.yaml | ||
| - path: manager_webhook_patch.yaml | ||
|
|
||
| # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. | ||
| # Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks. | ||
| # 'CERTMANAGER' needs to be enabled to use ca injection | ||
| - webhookcainjection_patch.yaml | ||
|
|
||
| # the following config is for teaching kustomize how to do var substitution | ||
| vars: | ||
| - name: CERTIFICATE_NAMESPACE # namespace of the certificate CR | ||
| objref: | ||
| kind: Certificate | ||
| group: cert-manager.io | ||
| version: v1 | ||
| name: serving-cert # this name should match the one in certificate.yaml | ||
| fieldref: | ||
| fieldpath: metadata.namespace | ||
| - name: CERTIFICATE_NAME | ||
| objref: | ||
| kind: Certificate | ||
| group: cert-manager.io | ||
| version: v1 | ||
| name: serving-cert # this name should match the one in certificate.yaml | ||
| - name: SERVICE_NAMESPACE # namespace of the service | ||
| objref: | ||
| kind: Service | ||
| version: v1 | ||
| name: webhook-service | ||
| fieldref: | ||
| fieldpath: metadata.namespace | ||
| - name: SERVICE_NAME | ||
| objref: | ||
| kind: Service | ||
| version: v1 | ||
| name: webhook-service | ||
| #- path: webhookcainjection_patch.yaml | ||
|
|
||
| replacements: | ||
| - source: # Uncomment the following block to enable certificates for metrics | ||
| kind: Service | ||
| version: v1 | ||
| name: controller-manager-metrics-service | ||
| fieldPath: metadata.name | ||
| targets: | ||
| - select: | ||
| kind: Certificate | ||
| group: cert-manager.io | ||
| version: v1 | ||
| name: metrics-certs | ||
| fieldPaths: | ||
| - spec.dnsNames.0 | ||
| - spec.dnsNames.1 | ||
| options: | ||
| delimiter: '.' | ||
| index: 0 | ||
| create: true | ||
|
|
||
| - source: | ||
| kind: Service | ||
| version: v1 | ||
| name: controller-manager-metrics-service | ||
| fieldPath: metadata.namespace | ||
| targets: | ||
| - select: | ||
| kind: Certificate | ||
| group: cert-manager.io | ||
| version: v1 | ||
| name: metrics-certs | ||
| fieldPaths: | ||
| - spec.dnsNames.0 | ||
| - spec.dnsNames.1 | ||
| options: | ||
| delimiter: '.' | ||
| index: 1 | ||
| create: true | ||
|
|
||
| - source: # Uncomment the following block if you have any webhook | ||
| kind: Service | ||
| version: v1 | ||
| name: webhook-service | ||
| fieldPath: .metadata.name # Name of the service | ||
| targets: | ||
| - select: | ||
| kind: Certificate | ||
| group: cert-manager.io | ||
| version: v1 | ||
| name: serving-cert | ||
| fieldPaths: | ||
| - .spec.dnsNames.0 | ||
| - .spec.dnsNames.1 | ||
| options: | ||
| delimiter: '.' | ||
| index: 0 | ||
| create: true | ||
| - source: | ||
| kind: Service | ||
| version: v1 | ||
| name: webhook-service | ||
| fieldPath: .metadata.namespace # Namespace of the service | ||
| targets: | ||
| - select: | ||
| kind: Certificate | ||
| group: cert-manager.io | ||
| version: v1 | ||
| name: serving-cert | ||
| fieldPaths: | ||
| - .spec.dnsNames.0 | ||
| - .spec.dnsNames.1 | ||
| options: | ||
| delimiter: '.' | ||
| index: 1 | ||
| create: true | ||
|
|
||
| - source: # Uncomment the following block if you have a ValidatingWebhook (--programmatic-validation) | ||
| kind: Certificate | ||
| group: cert-manager.io | ||
| version: v1 | ||
| name: serving-cert # This name should match the one in certificate.yaml | ||
| fieldPath: .metadata.namespace # Namespace of the certificate CR | ||
| targets: | ||
| - select: | ||
| kind: ValidatingWebhookConfiguration | ||
| fieldPaths: | ||
| - .metadata.annotations.[cert-manager.io/inject-ca-from] | ||
| options: | ||
| delimiter: '/' | ||
| index: 0 | ||
| create: true | ||
| - source: | ||
| kind: Certificate | ||
| group: cert-manager.io | ||
| version: v1 | ||
| name: serving-cert | ||
| fieldPath: .metadata.name | ||
| targets: | ||
| - select: | ||
| kind: ValidatingWebhookConfiguration | ||
| fieldPaths: | ||
| - .metadata.annotations.[cert-manager.io/inject-ca-from] | ||
| options: | ||
| delimiter: '/' | ||
| index: 1 | ||
| create: true | ||
|
|
||
| - source: # Uncomment the following block if you have a DefaultingWebhook (--defaulting ) | ||
| kind: Certificate | ||
| group: cert-manager.io | ||
| version: v1 | ||
| name: serving-cert | ||
| fieldPath: .metadata.namespace # Namespace of the certificate CR | ||
| targets: | ||
| - select: | ||
| kind: MutatingWebhookConfiguration | ||
| fieldPaths: | ||
| - .metadata.annotations.[cert-manager.io/inject-ca-from] | ||
| options: | ||
| delimiter: '/' | ||
| index: 0 | ||
| create: true | ||
| - source: | ||
| kind: Certificate | ||
| group: cert-manager.io | ||
| version: v1 | ||
| name: serving-cert | ||
| fieldPath: .metadata.name | ||
| targets: | ||
| - select: | ||
| kind: MutatingWebhookConfiguration | ||
| fieldPaths: | ||
| - .metadata.annotations.[cert-manager.io/inject-ca-from] | ||
| options: | ||
| delimiter: '/' | ||
| index: 1 | ||
| create: true |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| # This patch adds the args to allow exposing the metrics endpoint using HTTPS | ||
| - op: add | ||
| path: /spec/template/spec/containers/0/args/0 | ||
| value: --metrics-bind-address=:8443 |
File renamed without changes.
Oops, something went wrong.