-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat/fix: enhance cert-manager integration for metrics endpoints (fol…
…low-up to PR #4243) This commit is a follow-up to PR #4243, which introduced support for using cert-manager certificates for securing the metrics endpoint and ServiceMonitor. Key enhancements: - Added support for configuring certificate integration via a Kustomize patch. - Introduced configurable flags for greater flexibility in customization. - (fix)Updated the patch logic to append volumes and arguments without overwriting existing configurations, ensuring seamless integration. These improvements enhance usability and adaptability while maintaining compatibility with the initial implementation. As the feature has not yet been released, this update ensures a polished and user-friendly integration for upcoming releases.
- Loading branch information
1 parent
781e93f
commit 7bcaf26
Showing
38 changed files
with
623 additions
and
242 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -74,6 +74,9 @@ func main() { | |
| /* | ||
| */ | ||
| var metricsAddr string | ||
| var certDir string | ||
| var certName string | ||
| var certKey string | ||
| var enableLeaderElection bool | ||
| var probeAddr string | ||
| var secureMetrics bool | ||
|
|
@@ -87,6 +90,10 @@ func main() { | |
| "Enabling this will ensure there is only one active controller manager.") | ||
| flag.BoolVar(&secureMetrics, "metrics-secure", true, | ||
| "If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.") | ||
| flag.StringVar(&certDir, "cert-dir", "", | ||
| "The directory of TLS certificate to use for verifying HTTPS connections for the metrics server.") | ||
| flag.StringVar(&certName, "cert-name", "", "CertName is the server certificate name. Defaults to tls.crt") | ||
| flag.StringVar(&certKey, "cert-key", "", "KeyName is the server key name. Defaults to tls.key") | ||
| flag.BoolVar(&enableHTTP2, "enable-http2", false, | ||
| "If set, HTTP/2 will be enabled for the metrics and webhook servers") | ||
| opts := zap.Options{ | ||
|
|
@@ -133,15 +140,18 @@ func main() { | |
| // https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization | ||
| metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization | ||
|
|
||
| // TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically | ||
| // generate self-signed certificates for the metrics server. While convenient for development and testing, | ||
| // this setup is not recommended for production. | ||
| // If CertDir, CertName, and KeyName are not set, controller-runtime generates self-signed certificates | ||
| // for the metrics server, suitable for development but not recommended for production. | ||
| // To use cert-manager-managed certificates, enable [METRICS WITH CERTMANAGER] in | ||
| // config/default/kustomization.yaml and specify CertDir, CertName, and KeyName accordingly. | ||
| if certDir != "" { | ||
| metricsServerOptions.CertDir = certDir | ||
| } | ||
|
|
||
| // TODO(user): If cert-manager is enabled in config/default/kustomization.yaml, | ||
| // you can uncomment the following lines to use the certificate managed by cert-manager. | ||
| // metricsServerOptions.CertDir = "/tmp/k8s-metrics-server/metrics-certs" | ||
| // metricsServerOptions.CertName = "tls.crt" | ||
| // metricsServerOptions.KeyName = "tls.key" | ||
| if certName != "" && certKey != "" { | ||
| metricsServerOptions.CertName = certName | ||
| metricsServerOptions.KeyName = certKey | ||
| } | ||
|
|
||
| } | ||
|
|
||
|
|
||
64 changes: 43 additions & 21 deletions
64
...c/cronjob-tutorial/testdata/project/config/default/certmanager_metrics_manager_patch.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,21 +1,43 @@ | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: controller-manager | ||
| namespace: system | ||
| labels: | ||
| app.kubernetes.io/name: project | ||
| app.kubernetes.io/managed-by: kustomize | ||
| spec: | ||
| template: | ||
| spec: | ||
| containers: | ||
| - name: manager | ||
| volumeMounts: | ||
| - mountPath: /tmp/k8s-metrics-server/metrics-certs | ||
| name: metrics-certs | ||
| readOnly: true | ||
| volumes: | ||
| - name: metrics-certs | ||
| secret: | ||
| secretName: metrics-server-cert | ||
| # This patch adds the args and volumes to allow the manager to use the metrics-server certs | ||
| # Ensure the volumeMounts field exists by creating it if missing | ||
| - op: add | ||
| path: /spec/template/spec/containers/0/volumeMounts | ||
| value: [] | ||
| # Add the volume mount for the serving certificates | ||
| - op: add | ||
| path: /spec/template/spec/containers/0/volumeMounts/- | ||
| value: | ||
| mountPath: /tmp/k8s-metrics-server/serving-certs | ||
| name: metrics-certs | ||
| readOnly: true | ||
| # Add the cert-dir argument | ||
| - op: add | ||
| path: /spec/template/spec/containers/0/args/- | ||
| value: --cert-dir=/tmp/k8s-metrics-server/serving-certs | ||
| # Add the cert-name argument | ||
| - op: add | ||
| path: /spec/template/spec/containers/0/args/- | ||
| value: --cert-name=/tmp/k8s-metrics-server/serving-certs/tls.crt | ||
| # Add the cert-key argument | ||
| - op: add | ||
| path: /spec/template/spec/containers/0/args/- | ||
| value: --cert-key=/tmp/k8s-metrics-server/serving-certs/tls.key | ||
| # Ensure the volumes field exists by creating it if missing | ||
| - op: add | ||
| path: /spec/template/spec/volumes | ||
| value: [] | ||
| # Add the volume for the serving certificates | ||
| - op: add | ||
| path: /spec/template/spec/volumes/- | ||
| value: | ||
| name: metrics-certs | ||
| secret: | ||
| secretName: metrics-server-cert | ||
| optional: false | ||
| items: | ||
| - key: ca.crt | ||
| path: ca.crt | ||
| - key: tls.crt | ||
| path: tls.crt | ||
| - key: tls.key | ||
| path: tls.key |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -54,6 +54,9 @@ func init() { | |
|
|
||
| func main() { | ||
| var metricsAddr string | ||
| var certDir string | ||
| var certName string | ||
| var certKey string | ||
| var enableLeaderElection bool | ||
| var probeAddr string | ||
| var secureMetrics bool | ||
|
|
@@ -67,6 +70,10 @@ func main() { | |
| "Enabling this will ensure there is only one active controller manager.") | ||
| flag.BoolVar(&secureMetrics, "metrics-secure", true, | ||
| "If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.") | ||
| flag.StringVar(&certDir, "cert-dir", "", | ||
| "The directory of TLS certificate to use for verifying HTTPS connections for the metrics server.") | ||
| flag.StringVar(&certName, "cert-name", "", "CertName is the server certificate name. Defaults to tls.crt") | ||
| flag.StringVar(&certKey, "cert-key", "", "KeyName is the server key name. Defaults to tls.key") | ||
| flag.BoolVar(&enableHTTP2, "enable-http2", false, | ||
| "If set, HTTP/2 will be enabled for the metrics and webhook servers") | ||
| opts := zap.Options{ | ||
|
|
@@ -113,15 +120,18 @@ func main() { | |
| // https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization | ||
| metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization | ||
|
|
||
| // TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically | ||
| // generate self-signed certificates for the metrics server. While convenient for development and testing, | ||
| // this setup is not recommended for production. | ||
|
|
||
| // TODO(user): If cert-manager is enabled in config/default/kustomization.yaml, | ||
| // you can uncomment the following lines to use the certificate managed by cert-manager. | ||
| // metricsServerOptions.CertDir = "/tmp/k8s-metrics-server/metrics-certs" | ||
| // metricsServerOptions.CertName = "tls.crt" | ||
| // metricsServerOptions.KeyName = "tls.key" | ||
| // If CertDir, CertName, and KeyName are not set, controller-runtime generates self-signed certificates | ||
| // for the metrics server, suitable for development but not recommended for production. | ||
| // To use cert-manager-managed certificates, enable [METRICS WITH CERTMANAGER] in | ||
| // config/default/kustomization.yaml and specify CertDir, CertName, and KeyName accordingly. | ||
| if certDir != "" { | ||
| metricsServerOptions.CertDir = certDir | ||
| } | ||
|
|
||
| if certName != "" && certKey != "" { | ||
| metricsServerOptions.CertName = certName | ||
| metricsServerOptions.KeyName = certKey | ||
| } | ||
|
|
||
| } | ||
|
|
||
|
|
||
Oops, something went wrong.