Skip to content

Commit 90d14cc

Browse files
endocrimesendocrimes
authored
Merge pull request #363 from vdice/ref/rm-rbac-proxy
2 parents 07a3175 + 7ba1b0a commit 90d14cc

24 files changed

+420
-261
lines changed

‎charts/spin-operator/templates/deployment.yaml

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -71,21 +71,6 @@ spec:
7171
- mountPath: /tmp/k8s-webhook-server/serving-certs
7272
name: cert
7373
readOnly: true
74-
- args: {{- toYaml .Values.controllerManager.kubeRbacProxy.args | nindent 8 }}
75-
env:
76-
- name: KUBERNETES_CLUSTER_DOMAIN
77-
value: {{ quote .Values.kubernetesClusterDomain }}
78-
image: {{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag
79-
| default .Chart.AppVersion }}
80-
name: kube-rbac-proxy
81-
ports:
82-
- containerPort: 8443
83-
name: https
84-
protocol: TCP
85-
resources: {{- toYaml .Values.controllerManager.kubeRbacProxy.resources | nindent
86-
10 }}
87-
securityContext: {{- toYaml .Values.controllerManager.kubeRbacProxy.containerSecurityContext
88-
| nindent 10 }}
8974
securityContext:
9075
runAsNonRoot: true
9176
serviceAccountName: {{ include "spin-operator.fullname" . }}-controller-manager

‎charts/spin-operator/templates/manager-rbac.yaml

Lines changed: 3 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,14 @@ rules:
88
- apiGroups:
99
- ""
1010
resources:
11-
- secrets
11+
- events
1212
verbs:
1313
- create
14-
- delete
15-
- get
16-
- list
1714
- patch
18-
- update
19-
- watch
2015
- apiGroups:
2116
- ""
2217
resources:
18+
- secrets
2319
- services
2420
verbs:
2521
- create
@@ -47,17 +43,11 @@ rules:
4743
- deployments/status
4844
verbs:
4945
- get
50-
- apiGroups:
51-
- ""
52-
resources:
53-
- events
54-
verbs:
55-
- create
56-
- patch
5746
- apiGroups:
5847
- core.spinkube.dev
5948
resources:
6049
- spinappexecutors
50+
- spinapps
6151
verbs:
6252
- create
6353
- delete
@@ -76,25 +66,6 @@ rules:
7666
- core.spinkube.dev
7767
resources:
7868
- spinappexecutors/status
79-
verbs:
80-
- get
81-
- patch
82-
- update
83-
- apiGroups:
84-
- core.spinkube.dev
85-
resources:
86-
- spinapps
87-
verbs:
88-
- create
89-
- delete
90-
- get
91-
- list
92-
- patch
93-
- update
94-
- watch
95-
- apiGroups:
96-
- core.spinkube.dev
97-
resources:
9869
- spinapps/status
9970
verbs:
10071
- get

‎charts/spin-operator/templates/metrics-auth-rbac.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ include "spin-operator.fullname" . }}-metrics-auth-role
5+
labels:
6+
{{- include "spin-operator.labels" . | nindent 4 }}
7+
rules:
8+
- apiGroups:
9+
- authentication.k8s.io
10+
resources:
11+
- tokenreviews
12+
verbs:
13+
- create
14+
- apiGroups:
15+
- authorization.k8s.io
16+
resources:
17+
- subjectaccessreviews
18+
verbs:
19+
- create
20+
---
21+
apiVersion: rbac.authorization.k8s.io/v1
22+
kind: ClusterRoleBinding
23+
metadata:
24+
name: {{ include "spin-operator.fullname" . }}-metrics-auth-rolebinding
25+
labels:
26+
{{- include "spin-operator.labels" . | nindent 4 }}
27+
roleRef:
28+
apiGroup: rbac.authorization.k8s.io
29+
kind: ClusterRole
30+
name: '{{ include "spin-operator.fullname" . }}-metrics-auth-role'
31+
subjects:
32+
- kind: ServiceAccount
33+
name: '{{ include "spin-operator.fullname" . }}-controller-manager'
34+
namespace: '{{ .Release.Namespace }}'

‎charts/spin-operator/templates/metrics-reader-rbac.yaml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@ kind: ClusterRole
33
metadata:
44
name: {{ include "spin-operator.fullname" . }}-metrics-reader
55
labels:
6-
app.kubernetes.io/component: kube-rbac-proxy
7-
app.kubernetes.io/created-by: spin-operator
8-
app.kubernetes.io/part-of: spin-operator
96
{{- include "spin-operator.labels" . | nindent 4 }}
107
rules:
118
- nonResourceURLs:

‎charts/spin-operator/templates/proxy-rbac.yaml renamed to ‎charts/spin-operator/templates/metrics-role-and-binding.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
apiVersion: rbac.authorization.k8s.io/v1
22
kind: ClusterRole
33
metadata:
4-
name: {{ include "spin-operator.fullname" . }}-proxy-role
4+
name: {{ include "spin-operator.fullname" . }}-metrics-role
55
labels:
6-
app.kubernetes.io/component: kube-rbac-proxy
6+
app.kubernetes.io/component: metrics-server
77
app.kubernetes.io/created-by: spin-operator
88
app.kubernetes.io/part-of: spin-operator
99
{{- include "spin-operator.labels" . | nindent 4 }}
@@ -24,16 +24,16 @@ rules:
2424
apiVersion: rbac.authorization.k8s.io/v1
2525
kind: ClusterRoleBinding
2626
metadata:
27-
name: {{ include "spin-operator.fullname" . }}-proxy-rolebinding
27+
name: {{ include "spin-operator.fullname" . }}-metrics-rolebinding
2828
labels:
29-
app.kubernetes.io/component: kube-rbac-proxy
29+
app.kubernetes.io/component: metrics-server
3030
app.kubernetes.io/created-by: spin-operator
3131
app.kubernetes.io/part-of: spin-operator
3232
{{- include "spin-operator.labels" . | nindent 4 }}
3333
roleRef:
3434
apiGroup: rbac.authorization.k8s.io
3535
kind: ClusterRole
36-
name: '{{ include "spin-operator.fullname" . }}-proxy-role'
36+
name: '{{ include "spin-operator.fullname" . }}-metrics-role'
3737
subjects:
3838
- kind: ServiceAccount
3939
name: '{{ include "spin-operator.fullname" . }}-controller-manager'

‎charts/spin-operator/templates/metrics-service.yaml

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,8 @@
11
apiVersion: v1
22
kind: Service
33
metadata:
4-
name: {{ include "spin-operator.fullname" . }}-controller-manager-metrics-service
4+
name: {{ include "spin-operator.fullname" . }}-metrics-service
55
labels:
6-
app.kubernetes.io/component: kube-rbac-proxy
7-
app.kubernetes.io/created-by: spin-operator
8-
app.kubernetes.io/part-of: spin-operator
96
control-plane: controller-manager
107
{{- include "spin-operator.labels" . | nindent 4 }}
118
spec:

‎charts/spin-operator/values.yaml

Lines changed: 3 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ controllerManager:
88
## In general, these should be left as-is.
99
args:
1010
- --health-probe-bind-address=:8082
11-
- --metrics-bind-address=127.0.0.1:8080
11+
- --metrics-bind-address=:8443
1212
- --leader-elect
1313
- --enable-webhooks
1414
## containerSecurityContext defines privilege and access control for the
@@ -38,38 +38,6 @@ controllerManager:
3838
cpu: 10m
3939
memory: 64Mi
4040

41-
## kubeRbacProxy handles RBAC authorization with the Kubernetes API server.
42-
kubeRbacProxy:
43-
## args are the default arguments to supply to the RBAC proxy.
44-
## In general, these should be left as-is.
45-
args:
46-
- --secure-listen-address=0.0.0.0:8443
47-
- --upstream=http://127.0.0.1:8080/
48-
- --logtostderr=true
49-
- --v=0
50-
## containerSecurityContext defines privilege and access control for the
51-
## container.
52-
## See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
53-
containerSecurityContext:
54-
allowPrivilegeEscalation: false
55-
capabilities:
56-
drop:
57-
- ALL
58-
## image indicates which repository and tag combination will be used for
59-
## pulling the RBAC proxy image.
60-
image:
61-
repository: gcr.io/kubebuilder/kube-rbac-proxy
62-
tag: v0.15.0
63-
## resources represent default cpu/mem limits for the RBAC proxy container.
64-
resources:
65-
# TODO: update these per https://github.com/spinkube/spin-operator/issues/21
66-
limits:
67-
cpu: 500m
68-
memory: 128Mi
69-
requests:
70-
cpu: 5m
71-
memory: 64Mi
72-
7341
# replicas represent how many pod replicas of the controllerManager to run.
7442
replicas: 1
7543

@@ -83,13 +51,13 @@ kubernetesClusterDomain: cluster.local
8351

8452
## metricsService configuration.
8553
## This configuration should only be updated in tandem with corresponding
86-
## controller and RBAC proxy configuration.
54+
## controller configuration.
8755
metricsService:
8856
ports:
8957
- name: https
9058
port: 8443
9159
protocol: TCP
92-
targetPort: https
60+
targetPort: 8443
9361
type: ClusterIP
9462

9563
## webhookService configuration.

‎cmd/main.go

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ limitations under the License.
1717
package main
1818

1919
import (
20+
"crypto/tls"
2021
"flag"
2122
"os"
2223

@@ -32,6 +33,7 @@ import (
3233
ctrl "sigs.k8s.io/controller-runtime"
3334
"sigs.k8s.io/controller-runtime/pkg/healthz"
3435
"sigs.k8s.io/controller-runtime/pkg/log/zap"
36+
"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
3537
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
3638

3739
spinv1alpha1 "github.com/spinkube/spin-operator/api/v1alpha1"
@@ -58,12 +60,19 @@ func main() {
5860
var enableLeaderElection bool
5961
var probeAddr string
6062
var enableWebhooks bool
63+
var secureMetrics bool
64+
var enableHTTP2 bool
65+
var tlsOpts []func(*tls.Config)
6166
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
6267
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8082", "The address the probe endpoint binds to.")
6368
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
6469
"Enable leader election for controller manager. "+
6570
"Enabling this will ensure there is only one active controller manager.")
6671
flag.BoolVar(&enableWebhooks, "enable-webhooks", false, "Enable admission webhooks")
72+
flag.BoolVar(&secureMetrics, "metrics-secure", true,
73+
"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
74+
flag.BoolVar(&enableHTTP2, "enable-http2", false,
75+
"If set, HTTP/2 will be enabled for the metrics server")
6776
opts := zap.Options{
6877
Development: true,
6978
}
@@ -78,9 +87,46 @@ func main() {
7887
"enableLeaderElection", enableLeaderElection,
7988
"enableWebhooks", enableWebhooks)
8089

90+
// if the enable-http2 flag is false (the default), http/2 should be disabled
91+
// due to its vulnerabilities. More specifically, disabling http/2 will
92+
// prevent from being vulnerable to the HTTP/2 Stream Cancellation and
93+
// Rapid Reset CVEs. For more information see:
94+
// - https://github.com/advisories/GHSA-qppj-fm5r-hxr3
95+
// - https://github.com/advisories/GHSA-4374-p667-p6c8
96+
disableHTTP2 := func(c *tls.Config) {
97+
setupLog.Info("disabling http/2")
98+
c.NextProtos = []string{"http/1.1"}
99+
}
100+
101+
if !enableHTTP2 {
102+
tlsOpts = append(tlsOpts, disableHTTP2)
103+
}
104+
105+
// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
106+
// More info:
107+
// - https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/server
108+
// - https://book.kubebuilder.io/reference/metrics.html
109+
metricsServerOptions := metricsserver.Options{
110+
BindAddress: metricsAddr,
111+
SecureServing: secureMetrics,
112+
TLSOpts: tlsOpts,
113+
}
114+
115+
if secureMetrics {
116+
// FilterProvider is used to protect the metrics endpoint with authn/authz.
117+
// These configurations ensure that only authorized users and service accounts
118+
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
119+
// https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization
120+
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
121+
122+
// TODO(user): If CertDir, CertName, and KeyName are not specified, controller-runtime will automatically
123+
// generate self-signed certificates for the metrics server. While convenient for development and testing,
124+
// this setup is not recommended for production.
125+
}
126+
81127
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
82128
Scheme: scheme,
83-
Metrics: metricsserver.Options{BindAddress: metricsAddr},
129+
Metrics: metricsServerOptions,
84130
HealthProbeBindAddress: probeAddr,
85131
LeaderElection: enableLeaderElection,
86132
LeaderElectionID: "90ba2d18.spinkube.dev",

‎config/chart/values.yaml

Lines changed: 3 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ controllerManager:
88
## In general, these should be left as-is.
99
args:
1010
- --health-probe-bind-address=:8082
11-
- --metrics-bind-address=127.0.0.1:8080
11+
- --metrics-bind-address=:8443
1212
- --leader-elect
1313
- --enable-webhooks
1414
## containerSecurityContext defines privilege and access control for the
@@ -38,38 +38,6 @@ controllerManager:
3838
cpu: 10m
3939
memory: 64Mi
4040

41-
## kubeRbacProxy handles RBAC authorization with the Kubernetes API server.
42-
kubeRbacProxy:
43-
## args are the default arguments to supply to the RBAC proxy.
44-
## In general, these should be left as-is.
45-
args:
46-
- --secure-listen-address=0.0.0.0:8443
47-
- --upstream=http://127.0.0.1:8080/
48-
- --logtostderr=true
49-
- --v=0
50-
## containerSecurityContext defines privilege and access control for the
51-
## container.
52-
## See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
53-
containerSecurityContext:
54-
allowPrivilegeEscalation: false
55-
capabilities:
56-
drop:
57-
- ALL
58-
## image indicates which repository and tag combination will be used for
59-
## pulling the RBAC proxy image.
60-
image:
61-
repository: gcr.io/kubebuilder/kube-rbac-proxy
62-
tag: v0.15.0
63-
## resources represent default cpu/mem limits for the RBAC proxy container.
64-
resources:
65-
# TODO: update these per https://github.com/spinkube/spin-operator/issues/21
66-
limits:
67-
cpu: 500m
68-
memory: 128Mi
69-
requests:
70-
cpu: 5m
71-
memory: 64Mi
72-
7341
# replicas represent how many pod replicas of the controllerManager to run.
7442
replicas: 1
7543

@@ -83,13 +51,13 @@ kubernetesClusterDomain: cluster.local
8351

8452
## metricsService configuration.
8553
## This configuration should only be updated in tandem with corresponding
86-
## controller and RBAC proxy configuration.
54+
## controller configuration.
8755
metricsService:
8856
ports:
8957
- name: https
9058
port: 8443
9159
protocol: TCP
92-
targetPort: https
60+
targetPort: 8443
9361
type: ClusterIP
9462

9563
## webhookService configuration.

0 commit comments

Comments
 (0)