Skip to content

Commit 9e70a48

Browse files
tao12345666333tao12345666333
committed
chore: remove kube-rbac-proxy
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
1 parent dd397cf commit 9e70a48

5 files changed

Lines changed: 85 additions & 1 deletion

File tree

‎go.mod‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,13 @@ require (
3333
)
3434

3535
require (
36+
cel.dev/expr v0.18.0 // indirect
3637
cloud.google.com/go/auth v0.10.2 // indirect
3738
cloud.google.com/go/auth/oauth2adapt v0.2.5 // indirect
3839
filippo.io/edwards25519 v1.1.0 // indirect
3940
github.com/BurntSushi/toml v1.4.0 // indirect
41+
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
42+
github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
4043
github.com/avast/retry-go/v4 v4.6.0 // indirect
4144
github.com/aws/aws-sdk-go-v2 v1.32.5 // indirect
4245
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 // indirect
@@ -76,11 +79,13 @@ require (
7679
github.com/aws/smithy-go v1.22.1 // indirect
7780
github.com/bombsimon/logrusr/v3 v3.1.0 // indirect
7881
github.com/boombuler/barcode v1.0.1 // indirect
82+
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
7983
github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
8084
github.com/distribution/reference v0.6.0 // indirect
8185
github.com/ericlagergren/decimal v0.0.0-20240411145413-00de7ca16731 // indirect
8286
github.com/evanphx/json-patch v5.9.0+incompatible // indirect
8387
github.com/felixge/httpsnoop v1.0.4 // indirect
88+
github.com/fsnotify/fsnotify v1.7.0 // indirect
8489
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
8590
github.com/ghodss/yaml v1.0.0 // indirect
8691
github.com/go-logr/stdr v1.2.2 // indirect
@@ -91,11 +96,13 @@ require (
9196
github.com/gonvenience/text v1.0.7 // indirect
9297
github.com/gonvenience/wrap v1.1.2 // indirect
9398
github.com/gonvenience/ytbx v1.4.4 // indirect
99+
github.com/google/cel-go v0.22.0 // indirect
94100
github.com/google/gnostic-models v0.6.8 // indirect
95101
github.com/google/go-github/v48 v48.2.0 // indirect
96102
github.com/google/go-querystring v1.1.0 // indirect
97103
github.com/google/s2a-go v0.1.8 // indirect
98104
github.com/gorilla/websocket v1.5.1 // indirect
105+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
99106
github.com/gruntwork-io/go-commons v0.8.0 // indirect
100107
github.com/hashicorp/errwrap v1.1.0 // indirect
101108
github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -127,6 +134,7 @@ require (
127134
github.com/russross/blackfriday/v2 v2.1.0 // indirect
128135
github.com/sergi/go-diff v1.3.1 // indirect
129136
github.com/spf13/cobra v1.8.1 // indirect
137+
github.com/stoewer/go-strcase v1.3.0 // indirect
130138
github.com/stretchr/objx v0.5.2 // indirect
131139
github.com/texttheater/golang-levenshtein v1.0.1 // indirect
132140
github.com/tidwall/gjson v1.18.0 // indirect
@@ -137,8 +145,12 @@ require (
137145
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 // indirect
138146
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 // indirect
139147
go.opentelemetry.io/otel v1.29.0 // indirect
148+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect
149+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect
140150
go.opentelemetry.io/otel/metric v1.29.0 // indirect
151+
go.opentelemetry.io/otel/sdk v1.29.0 // indirect
141152
go.opentelemetry.io/otel/trace v1.29.0 // indirect
153+
go.opentelemetry.io/proto/otlp v1.3.1 // indirect
142154
go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
143155
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
144156
golang.org/x/tools v0.26.0 // indirect
@@ -149,6 +161,7 @@ require (
149161
k8s.io/component-helpers v0.0.0 // indirect
150162
k8s.io/controller-manager v0.0.0 // indirect
151163
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
164+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.0 // indirect
152165
)
153166

154167
require (

‎go.sum‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
cel.dev/expr v0.18.0 h1:CJ6drgk+Hf96lkLikr4rFf19WrU0BOWEihyZnI2TAzo=
2+
cel.dev/expr v0.18.0/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
13
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
24
cloud.google.com/go v0.116.0 h1:B3fRrSDkLRt5qSHWe40ERJvhvnQwdZiHu0bJOpldweE=
35
cloud.google.com/go v0.116.0/go.mod h1:cEPSRWPzZEswwdr9BxE6ChEn01dWlTaF05LiC2Xs70U=
@@ -22,8 +24,12 @@ github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3Q
2224
github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
2325
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
2426
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
27+
github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
28+
github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
2529
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
2630
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
31+
github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
32+
github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
2733
github.com/avast/retry-go/v4 v4.6.0 h1:K9xNA+KeB8HHc2aWFuLb25Offp+0iVRXEvFx8IinRJA=
2834
github.com/avast/retry-go/v4 v4.6.0/go.mod h1:gvWlPhBVsvBbLkVGDg/KwvBv0bEkCOLRRSHKIr2PyOE=
2935
github.com/aws/aws-sdk-go-v2 v1.32.5 h1:U8vdWJuY7ruAkzaOdD7guwJjD06YSKmnKCJs7s3IkIo=
@@ -215,6 +221,8 @@ github.com/gonvenience/wrap v1.1.2 h1:xPKxNwL1HCguwyM+HlP/1CIuc9LRd7k8RodLwe9YTZ
215221
github.com/gonvenience/wrap v1.1.2/go.mod h1:GiryBSXoI3BAAhbWD1cZVj7RZmtiu0ERi/6R6eJfslI=
216222
github.com/gonvenience/ytbx v1.4.4 h1:jQopwyaLsVGuwdxSiN4WkXjsEaFNPJ3V4lUj7eyEpzo=
217223
github.com/gonvenience/ytbx v1.4.4/go.mod h1:w37+MKCPcCMY/jpPNmEklD4xKqrOAVBO6kIWW2+uI6M=
224+
github.com/google/cel-go v0.22.0 h1:b3FJZxpiv1vTMo2/5RDUqAHPxkT8mmMfJIrq1llbf7g=
225+
github.com/google/cel-go v0.22.0/go.mod h1:BuznPXXfQDpXKWQ9sPW3TzlAJN5zzFe+i9tIs0yC4s8=
218226
github.com/google/certificate-transparency-go v1.1.7 h1:IASD+NtgSTJLPdzkthwvAG1ZVbF2WtFg4IvoA68XGSw=
219227
github.com/google/certificate-transparency-go v1.1.7/go.mod h1:FSSBo8fyMVgqptbfF6j5p/XNdgQftAhSmXcIxV9iphE=
220228
github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
@@ -257,7 +265,6 @@ github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
257265
github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
258266
github.com/gorilla/websocket v1.5.1 h1:gmztn0JnHVt9JZquRuzLw3g4wouNVzKL15iLr/zn/QY=
259267
github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY=
260-
github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
261268
github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0=
262269
github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
263270
github.com/gruntwork-io/go-commons v0.8.0 h1:k/yypwrPqSeYHevLlEDmvmgQzcyTwrlZGRaxEM6G0ro=
@@ -424,6 +431,8 @@ github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
424431
github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
425432
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
426433
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
434+
github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
435+
github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
427436
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
428437
github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
429438
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
@@ -488,6 +497,8 @@ go.opentelemetry.io/otel v1.29.0 h1:PdomN/Al4q/lN6iBJEN3AwPvUiHPMlt93c8bqTG5Llw=
488497
go.opentelemetry.io/otel v1.29.0/go.mod h1:N/WtXPs1CNCUEx+Agz5uouwCba+i+bJGFicT8SR4NP8=
489498
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 h1:3Q/xZUyC1BBkualc9ROb4G8qkH90LXEIICcs5zv1OYY=
490499
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI=
500+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 h1:qFffATk0X+HD+f1Z8lswGiOQYKHRlzfmdJm0wEaVrFA=
501+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0/go.mod h1:MOiCmryaYtc+V0Ei+Tx9o5S1ZjA7kzLucuVuyzBZloQ=
491502
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.28.0 h1:j9+03ymgYhPKmeXGk5Zu+cIZOlVzd9Zv7QIiyItjFBU=
492503
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.28.0/go.mod h1:Y5+XiUG4Emn1hTfciPzGPJaSI+RpDts6BnCIir0SLqk=
493504
go.opentelemetry.io/otel/metric v1.29.0 h1:vPf/HFWTNkPu1aYeIsc98l4ktOQaL6LeSoeV2g+8YLc=
@@ -689,6 +700,8 @@ k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6J
689700
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
690701
oras.land/oras-go/v2 v2.5.0 h1:o8Me9kLY74Vp5uw07QXPiitjsw7qNXi8Twd+19Zf02c=
691702
oras.land/oras-go/v2 v2.5.0/go.mod h1:z4eisnLP530vwIOUOJeBIj0aGI0L1C3d53atvCBqZHg=
703+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.0 h1:CPT0ExVicCzcpeN4baWEV2ko2Z/AsiZgEdwgcfwLgMo=
704+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
692705
sigs.k8s.io/controller-runtime v0.19.3 h1:XO2GvC9OPftRst6xWCpTgBZO04S2cbp0Qqkj8bX1sPw=
693706
sigs.k8s.io/controller-runtime v0.19.3/go.mod h1:j4j87DqtsThvwTv5/Tc5NFRyyF/RF0ip4+62tbTSIUM=
694707
sigs.k8s.io/gateway-api v1.2.1 h1:fZZ/+RyRb+Y5tGkwxFKuYuSRQHu9dZtbjenblleOLHM=

‎modules/cli/cli.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,15 @@ func New(m metadata.Info) *CLI {
2222

2323
var cfg manager.Config
2424
var deferCfg flagsForFurtherEvaluation
25+
// set default values for MetricsAccessFilter
26+
cfg.MetricsAccessFilter = manager.MetricsAccessFilterOff
2527

2628
flagSet.BoolVar(&cfg.AnonymousReports, "anonymous-reports", true, "Send anonymized usage data to help improve Kong.")
2729
flagSet.StringVar(&cfg.APIServerPath, "apiserver-host", "", "The Kubernetes API server URL. If not set, the operator will use cluster config discovery.")
2830
flagSet.StringVar(&cfg.KubeconfigPath, "kubeconfig", "", "Path to the kubeconfig file.")
2931

3032
flagSet.StringVar(&cfg.MetricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
33+
flagSet.Var(&cfg.MetricsAccessFilter, "metrics-access-filter", "Specifies the filter access function to be used for accessing the metrics endpoint (possible values: off, rbac).")
3134
flagSet.StringVar(&cfg.ProbeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
3235
flagSet.BoolVar(&deferCfg.DisableLeaderElection, "no-leader-election", false,
3336
"Disable leader election for controller manager. Disabling this will not ensure there is only one active controller manager.")

‎modules/cli/cli_test.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,17 @@ func TestParse(t *testing.T) {
9191
return cfg
9292
},
9393
},
94+
{
95+
name: "metrics access filter argument is set",
96+
args: []string{
97+
"--metrics-access-filter=rbac",
98+
},
99+
expectedCfg: func() manager.Config {
100+
cfg := expectedDefaultCfg()
101+
cfg.MetricsAccessFilter = "rbac"
102+
return cfg
103+
},
104+
},
94105
}
95106

96107
for _, tC := range testCases {
@@ -145,6 +156,7 @@ func TestParseWithAdditionalFlags(t *testing.T) {
145156
func expectedDefaultCfg() manager.Config {
146157
return manager.Config{
147158
MetricsAddr: ":8080",
159+
MetricsAccessFilter: "off",
148160
ProbeAddr: ":8081",
149161
WebhookCertDir: "/tmp/k8s-webhook-server/serving-certs",
150162
WebhookPort: 9443,

‎modules/manager/run.go‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727
"fmt"
2828
"math"
2929
"math/big"
30+
"net/http"
3031
"os"
3132
"time"
3233

@@ -43,6 +44,7 @@ import (
4344
"sigs.k8s.io/controller-runtime/pkg/healthz"
4445
"sigs.k8s.io/controller-runtime/pkg/log/zap"
4546
"sigs.k8s.io/controller-runtime/pkg/manager"
47+
"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
4648
"sigs.k8s.io/controller-runtime/pkg/metrics/server"
4749
"sigs.k8s.io/controller-runtime/pkg/webhook"
4850

@@ -57,9 +59,38 @@ const (
5759
tlsKeyFilename = "tls.key"
5860
)
5961

62+
// MetricsAccessFilter defines the access filter function for the metrics endpoint.
63+
type MetricsAccessFilter string
64+
65+
// Set implements flag.Value.
66+
func (mf *MetricsAccessFilter) Set(v string) error {
67+
switch v {
68+
case string(MetricsAccessFilterOff), string(MetricsAccessFilterRBAC):
69+
*mf = MetricsAccessFilter(v)
70+
default:
71+
return fmt.Errorf("invalid value %q for metrics access filter", v)
72+
}
73+
return nil
74+
}
75+
76+
const (
77+
// MetricsAccessFilterOff disabled the access filter on metrics endpoint.
78+
MetricsAccessFilterOff MetricsAccessFilter = "off"
79+
// MetricsAccessFilterRBAC enables the access filter on metrics endpoint.
80+
// For more information consult:
81+
// https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/metrics/filters#WithAuthenticationAndAuthorization
82+
MetricsAccessFilterRBAC MetricsAccessFilter = "rbac"
83+
)
84+
85+
// String returns the string representation of the MetricsFilter.
86+
func (mf MetricsAccessFilter) String() string {
87+
return string(mf)
88+
}
89+
6090
// Config represents the configuration for the manager.
6191
type Config struct {
6292
MetricsAddr string
93+
MetricsAccessFilter MetricsAccessFilter
6394
ProbeAddr string
6495
WebhookCertDir string
6596
WebhookPort int
@@ -107,6 +138,7 @@ func DefaultConfig() Config {
107138

108139
return Config{
109140
MetricsAddr: ":8080",
141+
MetricsAccessFilter: MetricsAccessFilterOff,
110142
ProbeAddr: ":8081",
111143
WebhookCertDir: defaultWebhookCertDir,
112144
WebhookPort: 9443,
@@ -178,6 +210,17 @@ func Run(
178210
Scheme: scheme,
179211
Metrics: server.Options{
180212
BindAddress: cfg.MetricsAddr,
213+
FilterProvider: func() func(c *rest.Config, httpClient *http.Client) (server.Filter, error) {
214+
switch cfg.MetricsAccessFilter {
215+
case MetricsAccessFilterRBAC:
216+
return filters.WithAuthenticationAndAuthorization
217+
case MetricsAccessFilterOff:
218+
return nil
219+
default:
220+
// This is checked in flags validation so this should never happen.
221+
panic("unsupported metrics filter")
222+
}
223+
}(),
181224
},
182225
WebhookServer: webhook.NewServer(
183226
webhook.Options{

0 commit comments

Comments
 (0)