Skip to content

Commit 834d079

Browse files
hongkailiuhongkailiu
committed
Define kube-rbac-proxy sidecar
1 parent 955e63b commit 834d079

File tree

3 files changed

+116
-18
lines changed

3 files changed

+116
-18
lines changed

‎install/0000_00_cluster-version-operator_02_secret.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
annotations:
5+
kubernetes.io/description: Secret containing the kube-rbac-proxy configuration.
6+
It allows only HTTPS requests to the /metrics endpoint for the Prometheus
7+
service account.
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
name: openshift-cluster-version-kube-rbac-proxy-metric
10+
namespace: openshift-cluster-version
11+
stringData:
12+
config.yaml: |-
13+
"authorization":
14+
"static":
15+
- "path": "/metrics"
16+
"resourceRequest": false
17+
"user":
18+
"name": "system:serviceaccount:openshift-monitoring:prometheus-k8s"
19+
"verb": "get"
20+
type: Opaque

‎install/0000_00_cluster-version-operator_03_deployment.yaml‎

Lines changed: 48 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,21 +24,60 @@ spec:
2424
spec:
2525
automountServiceAccountToken: false
2626
containers:
27+
- args:
28+
- --logtostderr
29+
- --secure-listen-address=[$(IP)]:9099
30+
- --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
31+
- --upstream=http://127.0.0.1:9099/
32+
- --tls-cert-file=/etc/tls/serving-cert/tls.crt
33+
- --tls-private-key-file=/etc/tls/serving-cert/tls.key
34+
- --client-ca-file=/etc/tls/service-ca/client-ca.crt
35+
- --config-file=/etc/kube-rbac-proxy/config.yaml
36+
env:
37+
- name: IP
38+
valueFrom:
39+
fieldRef:
40+
fieldPath: status.podIP
41+
image: quay.io/brancz/kube-rbac-proxy:v0.13.0
42+
name: kube-rbac-proxy
43+
ports:
44+
- containerPort: 9099
45+
hostPort: 9099
46+
name: metrics
47+
resources:
48+
requests:
49+
cpu: 1m
50+
memory: 15Mi
51+
securityContext:
52+
allowPrivilegeEscalation: false
53+
capabilities:
54+
drop:
55+
- ALL
56+
readOnlyRootFilesystem: true
57+
runAsGroup: 65532
58+
runAsNonRoot: true
59+
runAsUser: 65532
60+
terminationMessagePolicy: FallbackToLogsOnError
61+
volumeMounts:
62+
- mountPath: /etc/tls/serving-cert
63+
name: serving-cert
64+
readOnly: false
65+
- mountPath: /etc/tls/service-ca
66+
name: service-ca
67+
readOnly: false
68+
- mountPath: /etc/kube-rbac-proxy
69+
name: secret-kube-rbac-proxy-metric
70+
readOnly: true
2771
- name: cluster-version-operator
2872
image: '{{.ReleaseImage}}'
2973
imagePullPolicy: IfNotPresent
3074
args:
3175
- "start"
3276
- "--release-image={{.ReleaseImage}}"
3377
- "--enable-auto-update=false"
34-
- "--listen=0.0.0.0:9099"
35-
- "--serving-cert-file=/etc/tls/serving-cert/tls.crt"
36-
- "--serving-key-file=/etc/tls/serving-cert/tls.key"
78+
- "--listen=127.0.0.1:9099"
3779
- "--v=2"
3880
- "--always-enable-capabilities=Ingress"
39-
ports:
40-
- name: metrics
41-
containerPort: 9099
4281
resources:
4382
requests:
4483
cpu: 20m
@@ -51,9 +90,6 @@ spec:
5190
- mountPath: /etc/cvo/updatepayloads
5291
name: etc-cvo-updatepayloads
5392
readOnly: true
54-
- mountPath: /etc/tls/serving-cert
55-
name: serving-cert
56-
readOnly: true
5793
- mountPath: /etc/tls/service-ca
5894
name: service-ca
5995
readOnly: true
@@ -101,6 +137,9 @@ spec:
101137
effect: "NoExecute"
102138
tolerationSeconds: 120
103139
volumes:
140+
- name: secret-kube-rbac-proxy-metric
141+
secret:
142+
secretName: openshift-cluster-version-kube-rbac-proxy-metric
104143
- name: etc-ssl-certs
105144
hostPath:
106145
path: /etc/ssl/certs

‎pkg/payload/testdata/TestRenderManifest_expected_cvo_deployment.yaml‎

Lines changed: 48 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,21 +24,60 @@ spec:
2424
spec:
2525
automountServiceAccountToken: false
2626
containers:
27+
- args:
28+
- --logtostderr
29+
- --secure-listen-address=[$(IP)]:9099
30+
- --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
31+
- --upstream=http://127.0.0.1:9099/
32+
- --tls-cert-file=/etc/tls/serving-cert/tls.crt
33+
- --tls-private-key-file=/etc/tls/serving-cert/tls.key
34+
- --client-ca-file=/etc/tls/service-ca/client-ca.crt
35+
- --config-file=/etc/kube-rbac-proxy/config.yaml
36+
env:
37+
- name: IP
38+
valueFrom:
39+
fieldRef:
40+
fieldPath: status.podIP
41+
image: quay.io/brancz/kube-rbac-proxy:v0.13.0
42+
name: kube-rbac-proxy
43+
ports:
44+
- containerPort: 9099
45+
hostPort: 9099
46+
name: metrics
47+
resources:
48+
requests:
49+
cpu: 1m
50+
memory: 15Mi
51+
securityContext:
52+
allowPrivilegeEscalation: false
53+
capabilities:
54+
drop:
55+
- ALL
56+
readOnlyRootFilesystem: true
57+
runAsGroup: 65532
58+
runAsNonRoot: true
59+
runAsUser: 65532
60+
terminationMessagePolicy: FallbackToLogsOnError
61+
volumeMounts:
62+
- mountPath: /etc/tls/serving-cert
63+
name: serving-cert
64+
readOnly: false
65+
- mountPath: /etc/tls/service-ca
66+
name: service-ca
67+
readOnly: false
68+
- mountPath: /etc/kube-rbac-proxy
69+
name: secret-kube-rbac-proxy-metric
70+
readOnly: true
2771
- name: cluster-version-operator
2872
image: 'quay.io/cvo/release:latest'
2973
imagePullPolicy: IfNotPresent
3074
args:
3175
- "start"
3276
- "--release-image=quay.io/cvo/release:latest"
3377
- "--enable-auto-update=false"
34-
- "--listen=0.0.0.0:9099"
35-
- "--serving-cert-file=/etc/tls/serving-cert/tls.crt"
36-
- "--serving-key-file=/etc/tls/serving-cert/tls.key"
78+
- "--listen=127.0.0.1:9099"
3779
- "--v=2"
3880
- "--always-enable-capabilities=Ingress"
39-
ports:
40-
- name: metrics
41-
containerPort: 9099
4281
resources:
4382
requests:
4483
cpu: 20m
@@ -51,9 +90,6 @@ spec:
5190
- mountPath: /etc/cvo/updatepayloads
5291
name: etc-cvo-updatepayloads
5392
readOnly: true
54-
- mountPath: /etc/tls/serving-cert
55-
name: serving-cert
56-
readOnly: true
5793
- mountPath: /etc/tls/service-ca
5894
name: service-ca
5995
readOnly: true
@@ -101,6 +137,9 @@ spec:
101137
effect: "NoExecute"
102138
tolerationSeconds: 120
103139
volumes:
140+
- name: secret-kube-rbac-proxy-metric
141+
secret:
142+
secretName: openshift-cluster-version-kube-rbac-proxy-metric
104143
- name: etc-ssl-certs
105144
hostPath:
106145
path: /etc/ssl/certs

0 commit comments

Comments
 (0)