Skip to content

Commit 59a92f7

Browse files
author
Alex Johnson
committed
Conditionally enable FilterProvider in mainTemplate
* Enable `filters.WithAuthenticationAndAuthorization` only when `secureMetrics` is true Signed-off-by: Alex Johnson <hello@alex-johnson.net>
1 parent b3eeace commit 59a92f7

File tree

9 files changed

+217
-178
lines changed
  • docs/book/src
  • pkg/plugins/golang/v4/scaffolds/internal/templates
  • testdata
    • project-v4-multigroup-with-deploy-image/cmd
    • project-v4-multigroup/cmd
    • project-v4-with-deploy-image/cmd
    • project-v4-with-grafana/cmd
    • project-v4/cmd

9 files changed

+217
-178
lines changed

‎docs/book/src/cronjob-tutorial/testdata/project/cmd/main.go

Lines changed: 26 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -115,28 +115,33 @@ func main() {
115115
TLSOpts: tlsOpts,
116116
})
117117

118+
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
119+
// More info:
120+
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/server
121+
// - https://book.kubebuilder.io/reference/metrics.html
122+
metricsServerOptions := metricsserver.Options{
123+
BindAddress: metricsAddr,
124+
SecureServing: secureMetrics,
125+
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
126+
// not provided, self-signed certificates will be generated by default. This option is not recommended for
127+
// production environments as self-signed certificates do not offer the same level of trust and security
128+
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
129+
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
130+
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
131+
TLSOpts: tlsOpts,
132+
}
133+
134+
if secureMetrics {
135+
// FilterProvider is used to protect the metrics endpoint with authn/authz.
136+
// These configurations ensure that only authorized users and service accounts
137+
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
138+
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/filters#WithAuthenticationAndAuthorization
139+
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
140+
}
141+
118142
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
119-
Scheme: scheme,
120-
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
121-
// More info:
122-
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/server
123-
// - https://book.kubebuilder.io/reference/metrics.html
124-
Metrics: metricsserver.Options{
125-
BindAddress: metricsAddr,
126-
SecureServing: secureMetrics,
127-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
128-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
129-
// production environments as self-signed certificates do not offer the same level of trust and security
130-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
131-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
132-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
133-
TLSOpts: tlsOpts,
134-
// FilterProvider is used to protect the metrics endpoint with authn/authz.
135-
// These configurations ensure that only authorized users and service accounts
136-
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
137-
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/filters#WithAuthenticationAndAuthorization
138-
FilterProvider: filters.WithAuthenticationAndAuthorization,
139-
},
143+
Scheme: scheme,
144+
Metrics: metricsServerOptions,
140145
WebhookServer: webhookServer,
141146
HealthProbeBindAddress: probeAddr,
142147
LeaderElection: enableLeaderElection,

‎docs/book/src/getting-started/testdata/project/cmd/main.go

Lines changed: 26 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -96,28 +96,33 @@ func main() {
9696
TLSOpts: tlsOpts,
9797
})
9898

99+
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
100+
// More info:
101+
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/server
102+
// - https://book.kubebuilder.io/reference/metrics.html
103+
metricsServerOptions := metricsserver.Options{
104+
BindAddress: metricsAddr,
105+
SecureServing: secureMetrics,
106+
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
107+
// not provided, self-signed certificates will be generated by default. This option is not recommended for
108+
// production environments as self-signed certificates do not offer the same level of trust and security
109+
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
110+
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
111+
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
112+
TLSOpts: tlsOpts,
113+
}
114+
115+
if secureMetrics {
116+
// FilterProvider is used to protect the metrics endpoint with authn/authz.
117+
// These configurations ensure that only authorized users and service accounts
118+
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
119+
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/filters#WithAuthenticationAndAuthorization
120+
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
121+
}
122+
99123
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
100-
Scheme: scheme,
101-
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
102-
// More info:
103-
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/server
104-
// - https://book.kubebuilder.io/reference/metrics.html
105-
Metrics: metricsserver.Options{
106-
BindAddress: metricsAddr,
107-
SecureServing: secureMetrics,
108-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
109-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
110-
// production environments as self-signed certificates do not offer the same level of trust and security
111-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
112-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
113-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
114-
TLSOpts: tlsOpts,
115-
// FilterProvider is used to protect the metrics endpoint with authn/authz.
116-
// These configurations ensure that only authorized users and service accounts
117-
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
118-
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/filters#WithAuthenticationAndAuthorization
119-
FilterProvider: filters.WithAuthenticationAndAuthorization,
120-
},
124+
Scheme: scheme,
125+
Metrics: metricsServerOptions,
121126
WebhookServer: webhookServer,
122127
HealthProbeBindAddress: probeAddr,
123128
LeaderElection: enableLeaderElection,

‎docs/book/src/reference/metrics.md

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,9 @@ Therefore, you will find the following configuration:
8686
- In the `cmd/main.go`:
8787

8888
```go
89-
Metrics: metricsserver.Options{
90-
...
91-
FilterProvider: filters.WithAuthenticationAndAuthorization,
92-
...
89+
if secureMetrics {
90+
...
91+
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
9392
}
9493
```
9594

‎pkg/plugins/golang/v4/scaffolds/internal/templates/main.go

Lines changed: 32 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -232,9 +232,9 @@ func main() {
232232
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
233233
"Enable leader election for controller manager. " +
234234
"Enabling this will ensure there is only one active controller manager.")
235-
flag.BoolVar(&secureMetrics, "metrics-secure", true,
235+
flag.BoolVar(&secureMetrics, "metrics-secure", true,
236236
"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
237-
flag.BoolVar(&enableHTTP2, "enable-http2", false,
237+
flag.BoolVar(&enableHTTP2, "enable-http2", false,
238238
"If set, HTTP/2 will be enabled for the metrics and webhook servers")
239239
opts := zap.Options{
240240
Development: true,
@@ -264,29 +264,34 @@ func main() {
264264
TLSOpts: tlsOpts,
265265
})
266266
267+
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
268+
// More info:
269+
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@{{ .ControllerRuntimeVersion }}/pkg/metrics/server
270+
// - https://book.kubebuilder.io/reference/metrics.html
271+
metricsServerOptions := metricsserver.Options{
272+
BindAddress: metricsAddr,
273+
SecureServing: secureMetrics,
274+
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
275+
// not provided, self-signed certificates will be generated by default. This option is not recommended for
276+
// production environments as self-signed certificates do not offer the same level of trust and security
277+
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
278+
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
279+
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
280+
TLSOpts: tlsOpts,
281+
}
282+
283+
if secureMetrics {
284+
// FilterProvider is used to protect the metrics endpoint with authn/authz.
285+
// These configurations ensure that only authorized users and service accounts
286+
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
287+
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@{{ .ControllerRuntimeVersion }}/pkg/metrics/filters#WithAuthenticationAndAuthorization
288+
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
289+
}
290+
267291
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
268-
Scheme: scheme,
269-
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
270-
// More info:
271-
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@{{ .ControllerRuntimeVersion }}/pkg/metrics/server
272-
// - https://book.kubebuilder.io/reference/metrics.html
273-
Metrics: metricsserver.Options{
274-
BindAddress: metricsAddr,
275-
SecureServing: secureMetrics,
276-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
277-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
278-
// production environments as self-signed certificates do not offer the same level of trust and security
279-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
280-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
281-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
282-
TLSOpts: tlsOpts,
283-
// FilterProvider is used to protect the metrics endpoint with authn/authz.
284-
// These configurations ensure that only authorized users and service accounts
285-
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
286-
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@{{ .ControllerRuntimeVersion }}/pkg/metrics/filters#WithAuthenticationAndAuthorization
287-
FilterProvider: filters.WithAuthenticationAndAuthorization,
288-
},
289-
WebhookServer: webhookServer,
292+
Scheme: scheme,
293+
Metrics: metricsServerOptions,
294+
WebhookServer: webhookServer,
290295
HealthProbeBindAddress: probeAddr,
291296
LeaderElection: enableLeaderElection,
292297
{{- if not .Domain }}
@@ -300,9 +305,9 @@ func main() {
300305
// speeds up voluntary leader transitions as the new leader don't have to wait
301306
// LeaseDuration time first.
302307
//
303-
// In the default scaffold provided, the program ends immediately after
304-
// the manager stops, so would be fine to enable this option. However,
305-
// if you are doing or is intended to do any operation such as perform cleanups
308+
// In the default scaffold provided, the program ends immediately after
309+
// the manager stops, so would be fine to enable this option. However,
310+
// if you are doing or is intended to do any operation such as perform cleanups
306311
// after the manager stops then its usage might be unsafe.
307312
// LeaderElectionReleaseOnCancel: true,
308313
})

‎testdata/project-v4-multigroup-with-deploy-image/cmd/main.go

Lines changed: 26 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -121,28 +121,33 @@ func main() {
121121
TLSOpts: tlsOpts,
122122
})
123123

124+
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
125+
// More info:
126+
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/server
127+
// - https://book.kubebuilder.io/reference/metrics.html
128+
metricsServerOptions := metricsserver.Options{
129+
BindAddress: metricsAddr,
130+
SecureServing: secureMetrics,
131+
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
132+
// not provided, self-signed certificates will be generated by default. This option is not recommended for
133+
// production environments as self-signed certificates do not offer the same level of trust and security
134+
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
135+
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
136+
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
137+
TLSOpts: tlsOpts,
138+
}
139+
140+
if secureMetrics {
141+
// FilterProvider is used to protect the metrics endpoint with authn/authz.
142+
// These configurations ensure that only authorized users and service accounts
143+
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
144+
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/filters#WithAuthenticationAndAuthorization
145+
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
146+
}
147+
124148
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
125-
Scheme: scheme,
126-
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
127-
// More info:
128-
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/server
129-
// - https://book.kubebuilder.io/reference/metrics.html
130-
Metrics: metricsserver.Options{
131-
BindAddress: metricsAddr,
132-
SecureServing: secureMetrics,
133-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
134-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
135-
// production environments as self-signed certificates do not offer the same level of trust and security
136-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
137-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
138-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
139-
TLSOpts: tlsOpts,
140-
// FilterProvider is used to protect the metrics endpoint with authn/authz.
141-
// These configurations ensure that only authorized users and service accounts
142-
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
143-
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/filters#WithAuthenticationAndAuthorization
144-
FilterProvider: filters.WithAuthenticationAndAuthorization,
145-
},
149+
Scheme: scheme,
150+
Metrics: metricsServerOptions,
146151
WebhookServer: webhookServer,
147152
HealthProbeBindAddress: probeAddr,
148153
LeaderElection: enableLeaderElection,

‎testdata/project-v4-multigroup/cmd/main.go

Lines changed: 26 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -121,28 +121,33 @@ func main() {
121121
TLSOpts: tlsOpts,
122122
})
123123

124+
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
125+
// More info:
126+
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/server
127+
// - https://book.kubebuilder.io/reference/metrics.html
128+
metricsServerOptions := metricsserver.Options{
129+
BindAddress: metricsAddr,
130+
SecureServing: secureMetrics,
131+
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
132+
// not provided, self-signed certificates will be generated by default. This option is not recommended for
133+
// production environments as self-signed certificates do not offer the same level of trust and security
134+
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
135+
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
136+
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
137+
TLSOpts: tlsOpts,
138+
}
139+
140+
if secureMetrics {
141+
// FilterProvider is used to protect the metrics endpoint with authn/authz.
142+
// These configurations ensure that only authorized users and service accounts
143+
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
144+
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/filters#WithAuthenticationAndAuthorization
145+
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
146+
}
147+
124148
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
125-
Scheme: scheme,
126-
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
127-
// More info:
128-
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/server
129-
// - https://book.kubebuilder.io/reference/metrics.html
130-
Metrics: metricsserver.Options{
131-
BindAddress: metricsAddr,
132-
SecureServing: secureMetrics,
133-
// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
134-
// not provided, self-signed certificates will be generated by default. This option is not recommended for
135-
// production environments as self-signed certificates do not offer the same level of trust and security
136-
// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
137-
// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
138-
// to provide certificates, ensuring the server communicates using trusted and secure certificates.
139-
TLSOpts: tlsOpts,
140-
// FilterProvider is used to protect the metrics endpoint with authn/authz.
141-
// These configurations ensure that only authorized users and service accounts
142-
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
143-
// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/filters#WithAuthenticationAndAuthorization
144-
FilterProvider: filters.WithAuthenticationAndAuthorization,
145-
},
149+
Scheme: scheme,
150+
Metrics: metricsServerOptions,
146151
WebhookServer: webhookServer,
147152
HealthProbeBindAddress: probeAddr,
148153
LeaderElection: enableLeaderElection,

0 commit comments

Comments
 (0)