fix : remove kube-rbac-proxy sidecar metric proxy container from Operator deployment

[rohanKanojia]

What does this PR do?

⚠️ Requires #1435 to be merged first

As mentioned in #1352 and #1343 (comment) , using kube-rbac-proxy sidecar container is deprecated and is causing issues in configuring Operator resource/limits via Operator subscription.

This PR removes this sidecar container and uses controller-runtime's inbuilt WithAuthenticationAndAuthorization. Now that we don't have a proxy, we can directly post metrics on 8443 and 9443 ports for devworkspace-controller-manager and devworkspace-webhook-server respectively.

Signed-off-by: Rohan Kumar [email protected]

What issues does this PR fix or reference?

#1343

Is it tested? How?

After making changes I made sure operator is running and metrics are accessible on 8443 and 9443 ports.

• setup OpenShift cluster
• set NAMESPACE=devworkspace-controller
• set DWO_IMG to local docker image fork for development
• Checkout branch and create+push docker image make docker
• make install
• Check operator pods, they'd have only one running container (previously all pods have 2 containers each)

  devworkspace-operator : $ oc get pods
  NAME                                               READY   STATUS    RESTARTS      AGE
  devworkspace-controller-manager-56679dd464-lnh2g   1/1     Running   0             15m
  devworkspace-webhook-server-5874545c5c-58n4s       1/1     Running   0             15m
  devworkspace-webhook-server-5874545c5c-ntfmt       1/1     Running   1 (15m ago)   15m
  

• Port forward metrics service and try to access metrics

  kubectl  port-forward service/devworkspace-controller-metrics 8443:8443 &
  kubectl port-forward service/devworkspace-webhookserver 9443:9443
  
  # [In separate session]
   NAMESPACE=devworkspace-controller 
   kubectl create clusterrolebinding dw-metrics \
  --clusterrole=devworkspace-controller-metrics-reader \
  --serviceaccount=${NAMESPACE}:devworkspace-controller-serviceaccount
  TOKEN=$(kubectl create token devworkspace-controller-serviceaccount -n ${NAMESPACE} --duration=1h)
  curl -H "Authorization: Bearer ${TOKEN}"   http://localhost:9443/metrics
  curl -k -H "Authorization: Bearer ${TOKEN}" https://localhost:8443/metrics

PR Checklist

• E2E tests pass (when PR is ready, comment /test v8-devworkspace-operator-e2e, v8-che-happy-path to trigger)
  • v8-devworkspace-operator-e2e: DevWorkspace e2e test
  • v8-che-happy-path: Happy path for verification integration with Che

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rohanKanojia
Once this PR has been reviewed and has the lgtm label, please assign dkwon17 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rohanKanojia]

/ok-to-test

[rohanKanojia]

/ok-to-test

[openshift-merge-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.