feat(rh-shield-operator): upgrade base to 1.38.0 (#2098)

sysdiglabs · Jan 13, 2025 · c49141f · c49141f
1 parent 7d30304
commit c49141f
Show file tree

Hide file tree

Showing 22 changed files with 92 additions and 154 deletions.
diff --git a/rh-shield-operator/Dockerfile b/rh-shield-operator/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM quay.io/operator-framework/helm-operator:v1.36.1
+FROM quay.io/operator-framework/helm-operator:v1.38.0
 
 ARG RELEASE_VERSION
 

diff --git a/rh-shield-operator/Makefile b/rh-shield-operator/Makefile
@@ -3,7 +3,7 @@
 # To re-generate a bundle for another specific version without changing the standard setup, you can:
 # - use the VERSION as arg of the bundle target (e.g make bundle VERSION=0.0.2)
 # - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
-VERSION ?= 0.1.6
+VERSION ?= 0.2.0
 
 # CHANNELS define the bundle channels used in the bundle.
 # Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")
@@ -131,7 +131,7 @@ ifeq (,$(shell which kustomize 2>/dev/null))
 	@{ \
 	set -e ;\
 	mkdir -p $(dir $(KUSTOMIZE)) ;\
-	curl -sSLo - https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v5.3.0/kustomize_v5.3.0_$(OS)_$(ARCH).tar.gz | \
+	curl -sSLo - https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v5.4.2/kustomize_v5.4.2_$(OS)_$(ARCH).tar.gz | \
 	tar xzf - -C bin/ ;\
 	}
 else

diff --git a/rh-shield-operator/bundle.Dockerfile b/rh-shield-operator/bundle.Dockerfile
@@ -6,7 +6,7 @@ LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/
 LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
 LABEL operators.operatorframework.io.bundle.package.v1=rh-shield-operator
 LABEL operators.operatorframework.io.bundle.channels.v1=alpha
-LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.36.1
+LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.38.0
 LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1
 LABEL operators.operatorframework.io.metrics.project_layout=helm.sdk.operatorframework.io/v1
 

diff --git a/...or/bundle/manifests/rh-shield-operator-controller-manager-metrics-service_v1_service.yaml b/...or/bundle/manifests/rh-shield-operator-controller-manager-metrics-service_v1_service.yaml
@@ -12,7 +12,7 @@ spec:
   - name: https
     port: 8443
     protocol: TCP
-    targetPort: https
+    targetPort: 8443
   selector:
     control-plane: controller-manager
 status:

diff --git a/...manifests/rh-shield-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml b/...manifests/rh-shield-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml
@@ -2,9 +2,6 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   creationTimestamp: null
-  labels:
-    app.kubernetes.io/managed-by: kustomize
-    app.kubernetes.io/name: rh-shield-operator
   name: rh-shield-operator-metrics-reader
 rules:
 - nonResourceURLs:

diff --git a/rh-shield-operator/bundle/manifests/rh-shield-operator.clusterserviceversion.yaml b/rh-shield-operator/bundle/manifests/rh-shield-operator.clusterserviceversion.yaml
@@ -370,14 +370,14 @@ metadata:
       ]
     capabilities: Basic Install
     categories: Security, Monitoring
-    createdAt: "2024-12-09T17:08:58Z"
+    createdAt: "2025-01-02T15:51:05Z"
     description: |
       The Sysdig Shield Operator provides a way to deploy Sysdig Shield components on an OpenShift cluster.
-    operators.operatorframework.io/builder: operator-sdk-v1.36.1
+    operators.operatorframework.io/builder: operator-sdk-v1.38.0
     operators.operatorframework.io/project_layout: helm.sdk.operatorframework.io/v1
     repository: https://github.com/sysdiglabs/charts
     support: https://sysdig.com
-  name: rh-shield-operator.v0.1.6
+  name: rh-shield-operator.v0.2.0
   namespace: placeholder
 spec:
   apiservicedefinitions: {}
@@ -522,34 +522,13 @@ spec:
             spec:
               containers:
               - args:
-                - --secure-listen-address=0.0.0.0:8443
-                - --upstream=http://127.0.0.1:8080/
-                - --logtostderr=true
-                - --v=0
-                image: gcr.io/kubebuilder/kube-rbac-proxy:v0.16.0
-                name: kube-rbac-proxy
-                ports:
-                - containerPort: 8443
-                  name: https
-                  protocol: TCP
-                resources:
-                  limits:
-                    cpu: 500m
-                    memory: 128Mi
-                  requests:
-                    cpu: 5m
-                    memory: 64Mi
-                securityContext:
-                  allowPrivilegeEscalation: false
-                  capabilities:
-                    drop:
-                    - ALL
-              - args:
-                - --health-probe-bind-address=:8081
-                - --metrics-bind-address=127.0.0.1:8080
+                - --metrics-require-rbac
+                - --metrics-secure
+                - --metrics-bind-address=:8443
                 - --leader-elect
+                - --health-probe-bind-address=:8081
                 - --leader-election-id=rh-shield-operator
-                image: quay.io/sysdig/rh-shield-operator:v0.1.6
+                image: quay.io/sysdig/rh-shield-operator:v0.2.0
                 livenessProbe:
                   httpGet:
                     path: /healthz
@@ -653,4 +632,4 @@ spec:
   provider:
     name: Sysdig
     url: https://sysdig.com
-  version: 0.1.6
+  version: 0.2.0
diff --git a/rh-shield-operator/bundle/metadata/annotations.yaml b/rh-shield-operator/bundle/metadata/annotations.yaml
@@ -5,7 +5,7 @@ annotations:
   operators.operatorframework.io.bundle.metadata.v1: metadata/
   operators.operatorframework.io.bundle.package.v1: rh-shield-operator
   operators.operatorframework.io.bundle.channels.v1: alpha
-  operators.operatorframework.io.metrics.builder: operator-sdk-v1.36.1
+  operators.operatorframework.io.metrics.builder: operator-sdk-v1.38.0
   operators.operatorframework.io.metrics.mediatype.v1: metrics+v1
   operators.operatorframework.io.metrics.project_layout: helm.sdk.operatorframework.io/v1
 

diff --git a/rh-shield-operator/config/default/kustomization.yaml b/rh-shield-operator/config/default/kustomization.yaml
@@ -20,9 +20,13 @@ resources:
 - ../manager
 # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
 #- ../prometheus
+# [METRICS] Expose the controller manager metrics service.
+- metrics_service.yaml
 
+# Uncomment the patches line if you enable Metrics, and/or are using webhooks and cert-manager
 patches:
-# Protect the /metrics endpoint by putting it behind auth.
-# If you want your controller-manager to expose the /metrics
-# endpoint w/o any authn/z, please comment the following line.
-- path: manager_auth_proxy_patch.yaml
+# [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443.
+# More info: https://book.kubebuilder.io/reference/metrics
+- path: manager_metrics_patch.yaml
+  target:
+    kind: Deployment
diff --git a/rh-shield-operator/config/default/manager_auth_proxy_patch.yaml b/rh-shield-operator/config/default/manager_auth_proxy_patch.yaml
diff --git a/rh-shield-operator/config/default/manager_config_patch.yaml b/rh-shield-operator/config/default/manager_config_patch.yaml
diff --git a/rh-shield-operator/config/default/manager_metrics_patch.yaml b/rh-shield-operator/config/default/manager_metrics_patch.yaml
@@ -0,0 +1,12 @@
+# This patch adds the args to allow exposing the metrics endpoint using HTTPS
+- op: add
+  path: /spec/template/spec/containers/0/args/0
+  value: --metrics-bind-address=:8443
+# This patch adds the args to allow securing the metrics endpoint
+- op: add
+  path: /spec/template/spec/containers/0/args/0
+  value: --metrics-secure
+# This patch adds the args to allow RBAC-based authn/authz the metrics endpoint
+- op: add
+  path: /spec/template/spec/containers/0/args/0
+  value: --metrics-require-rbac
diff --git a/...rator/config/rbac/auth_proxy_service.yaml → ...rator/config/default/metrics_service.yaml b/...rator/config/rbac/auth_proxy_service.yaml → ...rator/config/default/metrics_service.yaml
@@ -9,9 +9,9 @@ metadata:
   namespace: system
 spec:
   ports:
-  - name: https
-    port: 8443
-    protocol: TCP
-    targetPort: https
+    - name: https
+      port: 8443
+      protocol: TCP
+      targetPort: 8443
   selector:
     control-plane: controller-manager
diff --git a/rh-shield-operator/config/manager/kustomization.yaml b/rh-shield-operator/config/manager/kustomization.yaml
@@ -5,4 +5,4 @@ kind: Kustomization
 images:
 - name: controller
   newName: quay.io/sysdig/rh-shield-operator
-  newTag: v0.1.6
+  newTag: v0.2.0
diff --git a/rh-shield-operator/config/manager/manager.yaml b/rh-shield-operator/config/manager/manager.yaml
@@ -60,6 +60,7 @@ spec:
       containers:
       - args:
         - --leader-elect
+        - --health-probe-bind-address=:8081
         - --leader-election-id=rh-shield-operator
         image: controller:latest
         name: manager

diff --git a/rh-shield-operator/config/prometheus/monitor.yaml b/rh-shield-operator/config/prometheus/monitor.yaml
@@ -11,11 +11,13 @@ metadata:
 spec:
   endpoints:
     - path: /metrics
-      port: https
+      port: https # Ensure this is the name of the port that exposes HTTPS metrics
       scheme: https
       bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
       tlsConfig:
-        insecureSkipVerify: true
+        caFile: /etc/metrics-certs/ca.crt
+        certFile: /etc/metrics-certs/tls.crt
+        keyFile: /etc/metrics-certs/tls.key
   selector:
     matchLabels:
       control-plane: controller-manager
diff --git a/rh-shield-operator/config/rbac/auth_proxy_client_clusterrole.yaml b/rh-shield-operator/config/rbac/auth_proxy_client_clusterrole.yaml
diff --git a/rh-shield-operator/config/rbac/auth_proxy_role.yaml b/rh-shield-operator/config/rbac/auth_proxy_role.yaml
diff --git a/rh-shield-operator/config/rbac/auth_proxy_role_binding.yaml b/rh-shield-operator/config/rbac/auth_proxy_role_binding.yaml
diff --git a/rh-shield-operator/config/rbac/kustomization.yaml b/rh-shield-operator/config/rbac/kustomization.yaml
@@ -9,13 +9,15 @@ resources:
 - role_binding.yaml
 - leader_election_role.yaml
 - leader_election_role_binding.yaml
-# Comment the following 4 lines if you want to disable
-# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
-# which protects your /metrics endpoint.
-- auth_proxy_service.yaml
-- auth_proxy_role.yaml
-- auth_proxy_role_binding.yaml
-- auth_proxy_client_clusterrole.yaml
+# The following RBAC configurations are used to protect
+# the metrics endpoint with authn/authz. These configurations
+# ensure that only authorized users and service accounts
+# can access the metrics endpoint. Comment the following
+# permissions if you want to disable this protection.
+# More info: https://book.kubebuilder.io/reference/metrics.html
+- metrics_auth_role.yaml
+- metrics_auth_role_binding.yaml
+- metrics_reader_role.yaml
 # For each CRD, "Editor" and "Viewer" roles are scaffolded by
 # default, aiding admins in cluster management. Those roles are
 # not used by the Project itself. You can comment the following lines

diff --git a/rh-shield-operator/config/rbac/metrics_auth_role.yaml b/rh-shield-operator/config/rbac/metrics_auth_role.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: metrics-auth-role
+rules:
+  - apiGroups:
+      - authentication.k8s.io
+    resources:
+      - tokenreviews
+    verbs:
+      - create
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - subjectaccessreviews
+    verbs:
+      - create
diff --git a/rh-shield-operator/config/rbac/metrics_auth_role_binding.yaml b/rh-shield-operator/config/rbac/metrics_auth_role_binding.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: metrics-auth-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: metrics-auth-role
+subjects:
+  - kind: ServiceAccount
+    name: controller-manager
+    namespace: system
diff --git a/rh-shield-operator/config/rbac/metrics_reader_role.yaml b/rh-shield-operator/config/rbac/metrics_reader_role.yaml
@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: metrics-reader
+rules:
+  - nonResourceURLs:
+      - "/metrics"
+    verbs:
+      - get