Skip to content

Commit 9f92834

Browse files
rajeshvenkatarajeshvenkata
committed
Add secure diagnostics endpoint with authentication to etcadm controller
1 parent 87940ab commit 9f92834

File tree

7 files changed

+374
-208
lines changed

7 files changed

+374
-208
lines changed

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ verify-mocks: mocks ## Verify if mocks need to be updated
123123
fi
124124

125125
$(CONTROLLER_GEN): $(TOOLS_BIN_DIR) # Build controller-gen from tools folder.
126-
GOBIN=$(ABS_TOOLS_BIN_DIR) go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.11.4
126+
GOBIN=$(ABS_TOOLS_BIN_DIR) go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.16.5
127127

128128
$(CONVERSION_GEN): $(TOOLS_BIN_DIR)
129129
GOBIN=$(ABS_TOOLS_BIN_DIR) go install k8s.io/code-generator/cmd/conversion-gen@v0.26.0

‎config/crd/bases/etcdcluster.cluster.x-k8s.io_etcdadmclusters.yaml‎

Lines changed: 300 additions & 188 deletions
Large diffs are not rendered by default.

‎config/manager/manager.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,14 @@ spec:
3333
- /manager
3434
args:
3535
- --enable-leader-election
36+
- --diagnostics-address=:8443
37+
- --insecure-diagnostics=false
3638
image: ${ETCDADM_CONTROLLER_IMAGE}
3739
name: manager
40+
ports:
41+
- containerPort: 8443
42+
name: metrics
43+
protocol: TCP
3844
resources:
3945
limits:
4046
cpu: 200m

‎config/rbac/role.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,18 @@ rules:
1818
- patch
1919
- update
2020
- watch
21+
- apiGroups:
22+
- authentication.k8s.io
23+
resources:
24+
- tokenreviews
25+
verbs:
26+
- create
27+
- apiGroups:
28+
- authorization.k8s.io
29+
resources:
30+
- subjectaccessreviews
31+
verbs:
32+
- create
2133
- apiGroups:
2234
- bootstrap.cluster.x-k8s.io
2335
resources:

‎go.mod‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ require (
1313
github.com/onsi/ginkgo/v2 v2.23.4
1414
github.com/onsi/gomega v1.38.0
1515
github.com/pkg/errors v0.9.1
16+
github.com/spf13/pflag v1.0.7
1617
go.etcd.io/etcd/api/v3 v3.5.22
1718
go.etcd.io/etcd/client/v3 v3.5.22
1819
k8s.io/api v0.33.3
@@ -21,22 +22,28 @@ require (
2122
k8s.io/client-go v0.33.3
2223
k8s.io/klog/v2 v2.130.1
2324
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
24-
sigs.k8s.io/cluster-api v1.6.0
25+
sigs.k8s.io/cluster-api v1.11.1
2526
sigs.k8s.io/controller-runtime v0.21.0
2627
sigs.k8s.io/etcdadm v0.1.5
2728
)
2829

2930
require (
31+
cel.dev/expr v0.19.1 // indirect
32+
github.com/NYTimes/gziphandler v1.1.1 // indirect
33+
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
3034
github.com/beorn7/perks v1.0.1 // indirect
3135
github.com/blang/semver/v4 v4.0.0 // indirect
36+
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
3237
github.com/cespare/xxhash/v2 v2.3.0 // indirect
3338
github.com/coreos/go-semver v0.3.1 // indirect
3439
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
3540
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
3641
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
3742
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
43+
github.com/felixge/httpsnoop v1.0.4 // indirect
3844
github.com/fsnotify/fsnotify v1.8.0 // indirect
3945
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
46+
github.com/go-logr/stdr v1.2.2 // indirect
4047
github.com/go-logr/zapr v1.3.0 // indirect
4148
github.com/go-openapi/jsonpointer v0.21.0 // indirect
4249
github.com/go-openapi/jsonreference v0.20.2 // indirect
@@ -46,12 +53,16 @@ require (
4653
github.com/gogo/protobuf v1.3.2 // indirect
4754
github.com/golang/protobuf v1.5.4 // indirect
4855
github.com/google/btree v1.1.3 // indirect
56+
github.com/google/cel-go v0.23.2 // indirect
4957
github.com/google/gnostic-models v0.6.9 // indirect
5058
github.com/google/go-cmp v0.7.0 // indirect
5159
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
60+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect
5261
github.com/hashicorp/errwrap v1.0.0 // indirect
62+
github.com/inconshreveable/mousetrap v1.1.0 // indirect
5363
github.com/josharian/intern v1.0.0 // indirect
5464
github.com/json-iterator/go v1.1.12 // indirect
65+
github.com/kylelemons/godebug v1.1.0 // indirect
5566
github.com/mailru/easyjson v0.7.7 // indirect
5667
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
5768
github.com/modern-go/reflect2 v1.0.2 // indirect
@@ -61,15 +72,24 @@ require (
6172
github.com/prometheus/common v0.62.0 // indirect
6273
github.com/prometheus/procfs v0.15.1 // indirect
6374
github.com/satori/go.uuid v1.2.0 // indirect
64-
github.com/spf13/pflag v1.0.7 // indirect
75+
github.com/spf13/cobra v1.9.1 // indirect
76+
github.com/stoewer/go-strcase v1.3.0 // indirect
6577
github.com/x448/float16 v0.8.4 // indirect
6678
go.etcd.io/etcd/client/pkg/v3 v3.5.22 // indirect
79+
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
80+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
6781
go.opentelemetry.io/otel v1.34.0 // indirect
82+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect
83+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 // indirect
84+
go.opentelemetry.io/otel/metric v1.34.0 // indirect
85+
go.opentelemetry.io/otel/sdk v1.34.0 // indirect
6886
go.opentelemetry.io/otel/trace v1.34.0 // indirect
87+
go.opentelemetry.io/proto/otlp v1.4.0 // indirect
6988
go.uber.org/automaxprocs v1.6.0 // indirect
7089
go.uber.org/multierr v1.11.0 // indirect
7190
go.uber.org/zap v1.27.0 // indirect
7291
go.yaml.in/yaml/v2 v2.4.2 // indirect
92+
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
7393
golang.org/x/net v0.42.0 // indirect
7494
golang.org/x/oauth2 v0.30.0 // indirect
7595
golang.org/x/sync v0.16.0 // indirect
@@ -90,6 +110,7 @@ require (
90110
k8s.io/cluster-bootstrap v0.33.3 // indirect
91111
k8s.io/component-base v0.33.3 // indirect
92112
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
113+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
93114
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
94115
sigs.k8s.io/randfill v1.0.0 // indirect
95116
sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect

‎go.sum‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lpr
2222
github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
2323
github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
2424
github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
25+
github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=
26+
github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
2527
github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
2628
github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
2729
github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
@@ -53,6 +55,7 @@ github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7/go.mod h1:F5haX7
5355
github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
5456
github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
5557
github.com/coreos/pkg v0.0.0-20180108230652-97fdf19511ea/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
58+
github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
5659
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
5760
github.com/davecgh/go-spew v0.0.0-20151105211317-5215b55f46b2/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5861
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -84,6 +87,7 @@ github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeME
8487
github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
8588
github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
8689
github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
90+
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
8791
github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
8892
github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
8993
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
@@ -157,7 +161,6 @@ github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:Fecb
157161
github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
158162
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
159163
github.com/grpc-ecosystem/grpc-gateway v1.8.6/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
160-
github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
161164
github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 h1:TmHmbvxPmaegwhDubVz0lICL0J5Ka2vwTzhoePEXsGE=
162165
github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0/go.mod h1:qztMSjm835F2bXf+5HKAPIS5qsmQDqZna/PgVt4rWtI=
163166
github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
@@ -264,6 +267,7 @@ github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoG
264267
github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
265268
github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
266269
github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
270+
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
267271
github.com/satori/go.uuid v1.2.0 h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww=
268272
github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
269273
github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
@@ -278,6 +282,7 @@ github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
278282
github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
279283
github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
280284
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
285+
github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
281286
github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
282287
github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
283288
github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=

‎main.go‎

Lines changed: 26 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,15 @@ import (
2525
"time"
2626

2727
etcdbp "github.com/aws/etcdadm-bootstrap-provider/api/v1beta1"
28+
"github.com/spf13/pflag"
2829
"k8s.io/apimachinery/pkg/runtime"
2930
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
3031
_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
3132
clusterv1 "sigs.k8s.io/cluster-api/api/core/v1beta2"
33+
capiflags "sigs.k8s.io/cluster-api/util/flags"
3234
ctrl "sigs.k8s.io/controller-runtime"
3335
"sigs.k8s.io/controller-runtime/pkg/cache"
3436
"sigs.k8s.io/controller-runtime/pkg/log/zap"
35-
"sigs.k8s.io/controller-runtime/pkg/metrics/server"
3637

3738
etcdclusterv1alpha3 "github.com/aws/etcdadm-controller/api/v1alpha3"
3839
etcdclusterv1beta1 "github.com/aws/etcdadm-controller/api/v1beta1"
@@ -41,9 +42,11 @@ import (
4142
)
4243

4344
var (
44-
scheme = runtime.NewScheme()
45-
setupLog = ctrl.Log.WithName("setup")
46-
watchNamespace string
45+
scheme = runtime.NewScheme()
46+
setupLog = ctrl.Log.WithName("setup")
47+
watchNamespace string
48+
managerOptions capiflags.ManagerOptions
49+
enableLeaderElection bool
4750
)
4851

4952
func init() {
@@ -56,28 +59,35 @@ func init() {
5659
// +kubebuilder:scaffold:scheme
5760
}
5861

62+
// +kubebuilder:rbac:groups=authentication.k8s.io,resources=tokenreviews,verbs=create
63+
// +kubebuilder:rbac:groups=authorization.k8s.io,resources=subjectaccessreviews,verbs=create
5964
func main() {
60-
var metricsAddr string
61-
var enableLeaderElection bool
6265
var maxConcurrentReconciles int
6366
var healthcheckInterval int
64-
flag.StringVar(&metricsAddr, "metrics-addr", "localhost:8080", "The address the metric endpoint binds to.")
65-
flag.BoolVar(&enableLeaderElection, "enable-leader-election", false,
67+
68+
pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
69+
capiflags.AddManagerOptions(pflag.CommandLine, &managerOptions)
70+
71+
pflag.BoolVar(&enableLeaderElection, "enable-leader-election", false,
6672
"Enable leader election for controller manager. "+
6773
"Enabling this will ensure there is only one active controller manager.")
68-
flag.StringVar(&watchNamespace, "namespace", "",
74+
pflag.StringVar(&watchNamespace, "namespace", "",
6975
"Namespace that the controller watches to reconcile etcdadmCluster objects. If unspecified, the controller watches for objects across all namespaces.")
70-
flag.IntVar(&maxConcurrentReconciles, "max-concurrent-reconciles", 10, "The maximum number of concurrent etcdadm-controller reconciles.")
71-
flag.IntVar(&healthcheckInterval, "healthcheck-interval", 30, "The time interval between each healthcheck loop in seconds.")
72-
flag.Parse()
76+
pflag.IntVar(&maxConcurrentReconciles, "max-concurrent-reconciles", 10, "The maximum number of concurrent etcdadm-controller reconciles.")
77+
pflag.IntVar(&healthcheckInterval, "healthcheck-interval", 30, "The time interval between each healthcheck loop in seconds.")
78+
pflag.Parse()
7379

7480
ctrl.SetLogger(zap.New(zap.UseDevMode(true)))
7581

82+
_, metricsServerOpts, err := capiflags.GetManagerOptions(managerOptions)
83+
if err != nil {
84+
setupLog.Error(err, "Unable to start manager: invalid metrics server flags")
85+
os.Exit(1)
86+
}
87+
7688
opts := ctrl.Options{
77-
Scheme: scheme,
78-
Metrics: server.Options{
79-
BindAddress: metricsAddr,
80-
},
89+
Scheme: scheme,
90+
Metrics: *metricsServerOpts,
8191
LeaderElection: enableLeaderElection,
8292
LeaderElectionID: "cc88008e.cluster.x-k8s.io",
8393
}

0 commit comments

Comments
 (0)