OCPBUGS-90506: Replace kube-rbac-proxy sidecar with controller-runtime FilterProvider - #502
Open
alebedev87 wants to merge 2 commits into
Open
OCPBUGS-90506: Replace kube-rbac-proxy sidecar with controller-runtime FilterProvider#502alebedev87 wants to merge 2 commits into
alebedev87 wants to merge 2 commits into
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 📝 WalkthroughWalkthroughThe operator now serves authenticated HTTPS metrics on Possibly related PRs
Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (2 errors, 1 warning)
✅ Passed checks (12 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@config/default/manager_insecure_tls_auth_proxy_patch.yaml`:
- Around line 1-3: The patch omits the `--metrics-tls-cert-dir` flag, causing
the operator to default to `/var/run/secrets/serving-cert` even though no cert
volume is mounted in this development/testing configuration. Add an explicit
`--metrics-tls-cert-dir` argument to the manager container args in the patch and
set it to an empty string or a temporary directory path so that self-signed
metrics certificates are generated in a writable location instead of the missing
mounted volume.
In `@go.mod`:
- Line 115: The go.opentelemetry.io/otel/sdk dependency is pinned to v1.33.0
which contains security vulnerabilities that are only fixed in v1.43.0 or later.
Update the go.opentelemetry.io/otel/sdk version from v1.33.0 to v1.43.0 in the
go.mod file. After updating, also refresh any dependent OTLP modules that
reference go.opentelemetry.io/otel/sdk to maintain version coherence across all
module dependencies.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: c21c0e2e-83b7-4804-8a26-62c854f58c6d
⛔ Files ignored due to path filters (287)
go.sumis excluded by!**/*.sumvendor/cel.dev/expr/.bazelversionis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/.gitattributesis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/CODE_OF_CONDUCT.mdis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/CONTRIBUTING.mdis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/GOVERNANCE.mdis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/MAINTAINERS.mdis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/MODULE.bazelis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/README.mdis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/WORKSPACEis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/WORKSPACE.bzlmodis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/checked.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/cloudbuild.yamlis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/eval.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/explain.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/regen_go_proto.shis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/regen_go_proto_canonical_protos.shis excluded by!**/vendor/**,!vendor/**vendor/cel.dev/expr/syntax.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/cel.dev/expr/value.pb.gois excluded by!**/*.pb.go,!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/antlrdoc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_config_set.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_deserialization_options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_deserializer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_simulator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_state.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/atn_type.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/char_stream.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/common_token_factory.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/common_token_stream.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/comparators.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/configuration.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/dfa.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/dfa_serializer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/dfa_state.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/diagnostic_error_listener.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/error_listener.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/error_strategy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/file_stream.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/input_stream.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/int_stream.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/interval_set.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/jcollect.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/lexer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/lexer_action.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/lexer_action_executor.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/lexer_atn_simulator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/ll1_analyzer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/nostatistics.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/parser.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/parser_atn_simulator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/parser_rule_context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/prediction_context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/prediction_context_cache.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/prediction_mode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/recognizer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/rule_context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/semantic_context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/statistics.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/stats_data.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/token.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/token_source.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/token_stream.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/tokenstream_rewriter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/trace_listener.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/transition.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/tree.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/trees.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/antlr4-go/antlr/v4/utils.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/backoff.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/exponential.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/retry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/ticker.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/timer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/cenkalti/backoff/v4/tries.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/cel.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/decls.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/env.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/folding.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/inlining.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/io.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/library.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/macro.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/optimizer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/program.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/cel/validator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/checker.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/cost.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/decls/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/decls/decls.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/env.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/format.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/mapping.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/printer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/scopes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/checker/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/ast/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/ast/ast.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/ast/conversion.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/ast/expr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/ast/factory.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/ast/navigable.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/containers/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/containers/container.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/cost.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/debug/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/debug/debug.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/decls/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/decls/decls.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/functions/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/functions/functions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/location.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/operators/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/operators/operators.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/overloads/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/overloads/overloads.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/runes/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/runes/buffer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/source.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/stdlib/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/stdlib/standard.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/any_value.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/bool.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/bytes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/compare.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/double.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/duration.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/err.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/int.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/iterator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/json_value.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/list.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/map.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/null.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/object.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/optional.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/overflow.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/checked.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/enum.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/equal.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/file.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/pb.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/pb/type.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/provider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/ref/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/ref/provider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/ref/reference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/string.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/timestamp.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/comparer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/container.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/field_tester.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/indexer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/iterator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/lister.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/mapper.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/matcher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/math.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/receiver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/sizer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/traits.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/traits/zeroer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/uint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/unknown.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/common/types/util.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/bindings.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/comprehensions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/encoders.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/formatting.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/guards.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/lists.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/math.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/native.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/protos.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/sets.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/ext/strings.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/activation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/attribute_patterns.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/attributes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/decorators.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/dispatcher.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/evalstate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/functions/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/functions/functions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/interpretable.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/interpreter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/optimizations.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/planner.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/prune.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/interpreter/runtimecost.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/BUILD.bazelis excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/CEL.g4is excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/CEL.interpis excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/CEL.tokensis excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/CELLexer.interpis excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/CELLexer.tokensis excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/cel_base_listener.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/cel_base_visitor.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/cel_lexer.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/cel_listener.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/cel_parser.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/cel_visitor.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/doc.gois excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/gen/generate.shis excluded by!**/gen/**,!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/helper.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/input.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/macro.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/options.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/parser.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/unescape.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/google/cel-go/parser/unparser.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/compile.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/fuzz.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/parse.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/convert.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/fieldmask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/handler.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_httpbodyproto.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_json.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_proto.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshaler.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshaler_registry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/pattern.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/proto2_convert.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/query.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/BUILD.bazelis excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/pattern.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/readerfactory.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/string_array_flag.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/trie.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/.gitignoreis excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/.golangci.ymlis excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/README.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/camel.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/helper.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/kebab.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/stoewer/go-strcase/snake.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/README.mdis excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/clients.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/doc.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.gois excluded by!**/vendor/**,!vendor/**vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/attribute.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (13)
bundle/manifests/external-dns-operator.clusterserviceversion.yamlconfig/default/kustomization.yamlconfig/default/manager_auth_proxy_patch.yamlconfig/default/manager_insecure_tls_auth_proxy_patch.yamlconfig/manager/manager.yamlconfig/rbac/auth_proxy_role.yamlconfig/rbac/auth_proxy_role_binding.yamlconfig/rbac/kustomization.yamlconfig/rbac/role.yamlgo.modmain.gopkg/operator/config/config.gopkg/operator/operator.go
💤 Files with no reviewable changes (3)
- config/rbac/kustomization.yaml
- config/rbac/auth_proxy_role.yaml
- config/rbac/auth_proxy_role_binding.yaml
openshift-ci
Bot
added
the
needs-rebase
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@config/manager/manager.yaml`:
- Around line 71-79: Add CPU and memory limits to every container resource
specification in the manager configuration, including the operator container and
embedded OLM deployment, while preserving the existing requests. Ensure each
container defines both limits.cpu and limits.memory as required by the path
instructions.
- Around line 71-79: Update the operator container security context in
manager.yaml to set readOnlyRootFilesystem: true, while preserving the existing
read-only metrics and webhook Secret mounts. If the operator requires runtime
writes, add only the necessary emptyDir mount, and apply the same setting to the
embedded OLM deployment.
- Around line 35-46: Add a NetworkPolicy alongside the manager workload in
manager.yaml, selecting the manager pods and allowing ingress only to TCP port
8443 from the intended Prometheus source pods or namespace. Deny all other
ingress to the metrics endpoint while preserving the existing metrics container
port configuration.
- Around line 44-46: Add a livenessProbe to the rendered Deployment alongside
the existing readinessProbe, reusing the same health-check port and endpoint
configuration. Keep the probe settings consistent with the readiness check so
hung or deadlocked containers can be restarted.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
alebedev87
force-pushed
the
metrics-cmd
branch
2 times, most recently
from
August 4, 2026 08:47
c5bf61f to
08e30eb
Compare
openshift-ci
Bot
removed
the
needs-rebase
alebedev87
changed the title
kube-rbac-proxy sidecar with controller-runtime FilterProviderkube-rbac-proxy sidecar with controller-runtime FilterProvider
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
There was a problem hiding this comment.
♻️ Duplicate comments (1)
go.mod (1)
111-117: 🔒 Security & Privacy | 🟠 MajorSecurity Misconfiguration (CWE-426): Untrusted Search Path
Upgrade the vulnerable OpenTelemetry modules before merge.
Line 115 still pins
go.opentelemetry.io/otel/sdk v1.33.0. OSV lists this version in the affected range for GO-2026-4394, fixed in v1.40.0, and GO-2026-5426, fixed in v1.43.0. Upgrade the OpenTelemetry API, SDK, metric, trace, and OTLP modules together to at least v1.43.0, then regeneratego.sum. Confirm the supported target platforms because the reported paths affect Darwin and BSD/Solaris systems. (osv.dev)#!/bin/bash set -euo pipefail for id in GO-2026-4394 GO-2026-5426; do curl -sS "https://api.osv.dev/v1/vulns/${id}" | jq '{id, aliases, affected}' done go mod verify go list -m -f '{{.Path}} {{.Version}}' \ go.opentelemetry.io/otel \ go.opentelemetry.io/otel/exporters/otlp/otlptrace \ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc \ go.opentelemetry.io/otel/metric \ go.opentelemetry.io/otel/sdk \ go.opentelemetry.io/otel/trace🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 111 - 117, Upgrade all OpenTelemetry modules shown in go.mod—including API, SDK, metric, trace, and OTLP exporter/protocol modules—to at least v1.43.0 as a consistent set, then regenerate go.sum and verify the resolved dependencies with go mod verify and go list. Confirm the resulting dependency versions support the affected Darwin and BSD/Solaris target platforms.Sources: MCP tools, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@go.mod`:
- Around line 111-117: Upgrade all OpenTelemetry modules shown in
go.mod—including API, SDK, metric, trace, and OTLP exporter/protocol modules—to
at least v1.43.0 as a consistent set, then regenerate go.sum and verify the
resolved dependencies with go mod verify and go list. Confirm the resulting
dependency versions support the affected Darwin and BSD/Solaris target
platforms.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 36: Update the production dependency versions for
github.com/google/cel-go to v0.29.0 and go.opentelemetry.io/otel/sdk to v1.40.0,
including any corresponding go.mod/go.sum entries required by the module graph.
Do not upgrade google.golang.org/grpc solely for the test/e2e-only reachability
noted in the review.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| ) | ||
|
|
||
| require ( | ||
| cel.dev/expr v0.19.1 // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
go mod verify
osv-scanner scan source -r .
go-licenses check ./...
awk '$0 ~ /\/\/ indirect$/ {print $1}' go.mod |
while read -r module; do
go mod why -m "$module"
done
rg -n -i 'sbom|provenance|attest|sigstore|cosign|sign' \
.github Makefile* Dockerfile* 2>/dev/null || trueRepository: openshift/external-dns-operator
Length of output: 3776
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- go.mod ---'
cat -n go.mod
printf '%s\n' '--- matching go.sum entries ---'
python3 - <<'PY'
from pathlib import Path
mods = []
for line in Path("go.mod").read_text().splitlines():
parts = line.split()
if len(parts) >= 2 and not line.lstrip().startswith(("module ", "go ", "toolchain ")):
mods.append((parts[0], parts[1]))
sum_text = Path("go.sum").read_text() if Path("go.sum").exists() else ""
for mod, ver in mods:
matches = [line for line in sum_text.splitlines()
if line.startswith(f"{mod} {ver} ")]
print(f"{mod} {ver}: {'; '.join(matches) if matches else 'MISSING'}")
PY
printf '%s\n' '--- release and dependency controls ---'
find .github -maxdepth 3 -type f -print 2>/dev/null | sort
rg -n -i 'sbom|provenance|attest|sigstore|cosign|sign|osv|license|go mod verify|vendor' \
.github Makefile* Dockerfile* go.mod go.sum 2>/dev/null || trueRepository: openshift/external-dns-operator
Length of output: 28542
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- dependency provenance ---'
for module in \
cel.dev/expr \
github.com/google/cel-go \
go.opentelemetry.io/otel/sdk \
google.golang.org/grpc
do
printf '\n[%s]\n' "$module"
go mod why -m "$module" 2>&1 || true
done
printf '%s\n' '--- tracked release and dependency-control files ---'
git ls-files | rg '(^|/)(go\.mod|go\.sum|vendor/|\.github/|Makefile|Dockerfile|.*(sbom|provenance|attest|cosign|sigstore|sign).*)$' || true
printf '%s\n' '--- relevant vendored license files ---'
find vendor -type f \( -iname 'LICENSE*' -o -iname 'COPYING*' -o -iname 'NOTICE*' \) \
2>/dev/null | rg 'cel|otel|grpc|google' || true
printf '%s\n' '--- exact checksum coverage for go.mod modules ---'
python3 - <<'PY'
from pathlib import Path
import re
text = Path("go.mod").read_text()
mods = []
in_require = False
for raw in text.splitlines():
line = raw.strip()
if line.startswith("require ("):
in_require = True
continue
if in_require and line == ")":
in_require = False
continue
if in_require:
m = re.match(r"(\S+)\s+(\S+)", line)
if m:
mods.append(m.groups())
sums = Path("go.sum").read_text().splitlines()
missing = []
for mod, ver in mods:
if not any(line.startswith(f"{mod} {ver} ") for line in sums):
missing.append(f"{mod} {ver}")
print(f"module_entries={len(mods)} missing_checksums={len(missing)}")
for item in missing:
print(item)
PYRepository: openshift/external-dns-operator
Length of output: 13594
Vulnerable Dependency (CWE-1104)
Upgrade the production-reachable vulnerable dependencies.
github.com/google/cel-go v0.23.2 and go.opentelemetry.io/otel/sdk v1.33.0 are reachable from production packages and have OSV fixes at v0.29.0 and v1.40.0. Upgrade them before merge. google.golang.org/grpc v1.68.1 is reachable only through test/e2e in this graph.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 36, Update the production dependency versions for
github.com/google/cel-go to v0.29.0 and go.opentelemetry.io/otel/sdk to v1.40.0,
including any corresponding go.mod/go.sum entries required by the module graph.
Do not upgrade google.golang.org/grpc solely for the test/e2e-only reachability
noted in the review.
Source: Path instructions
Contributor
Author
There was a problem hiding this comment.
Same reasoning as for otel/sdk. It's an indirect dependency which we will handle as part of the regular k8s/controller-runtime bump.
Contributor
Author
|
/retest-required |
Contributor
|
/assign @bentito |
Contributor
|
/retitle OCPBUGS-90506: Replace kube-rbac-proxy sidecar with controller-runtime FilterProvider |
openshift-ci
Bot
changed the title
kube-rbac-proxy sidecar with controller-runtime FilterProvider
openshift-ci-robot
added
jira/severity-moderate
|
@alebedev87: This pull request references Jira Issue OCPBUGS-90506, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
needs-rebase
…ider` Replace the `kube-rbac-proxy` sidecar container with controller-runtime's built-in `filters.WithAuthenticationAndAuthorization` for metrics endpoint authentication and authorization. The operator now handles TLS termination and Kubernetes TokenReview/SubjectAccessReview directly, eliminating the need for a separate proxy container. - Configure `metrics.Options` with `SecureServing`, `FilterProvider`, and OpenShift serving certs - Move metrics flags, port, volume, and volumeMount directly into `config/manager/manager.yaml` instead of a kustomize strategic merge patch - Remove `kube-rbac-proxy` sidecar from the deployment and CSV - Delete `auth_proxy_role.yaml` and `auth_proxy_role_binding.yaml`; add `tokenreviews` and `subjectaccessreviews` permissions to the main operator ClusterRole - Delete `manager_auth_proxy_patch.yaml` and `manager_insecure_tls_auth_proxy_patch.yaml` Co-Authored-By: Claude
alebedev87
force-pushed
the
metrics-cmd
branch
from
August 19, 2026 16:46
08e30eb to
4eb8a18
Compare
openshift-ci
Bot
removed
the
needs-rebase
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Register `healthz.Ping` on the `/healthz` endpoint and add a `livenessProbe` to the deployment manifests. This ensures kubelet restarts the operator pod if the process becomes unresponsive. Co-Authored-By: Claude
|
/lgtm |
Contributor
|
@alebedev87: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| protocol: TCP | ||
| - containerPort: 8443 | ||
| name: https | ||
| livenessProbe: |
Contributor
There was a problem hiding this comment.
It looks like the bundle needs to be regenerated with make bundle for the order to match with what's generated in the verify test but otherwise
/lgtm
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replace the
kube-rbac-proxysidecar container with controller-runtime's built-infilters.WithAuthenticationAndAuthorizationfor metrics endpoint authentication and authorization. The operator now handles TLS termination and Kubernetes TokenReview/SubjectAccessReview directly, eliminating the need for a separate proxy container and its image dependency.metrics.OptionswithSecureServing,FilterProvider, and OpenShift serving certs mounted from the service-ca annotation--metrics-tls-cert-dir), port, volume, and volumeMount directly intoconfig/manager/manager.yamlinstead of using a kustomize strategic merge patch that duplicated the full args listkube-rbac-proxysidecar container from the deployment and CSVauth_proxy_role.yamlandauth_proxy_role_binding.yaml; consolidatetokenreviewsandsubjectaccessreviewspermissions into the main operator ClusterRolemanager_auth_proxy_patch.yamlandmanager_insecure_tls_auth_proxy_patch.yamlScreenshot of scraped EDO metrics from OpenShift console