Skip to content

Commit f248957

Browse files
authored
allow authenticated metrics for namespace-lister (#6169)
We were allowing anyone who could access our metrics port to scrape our metrics, even though our servicemonitor was configured to use a bearer token to authenticate. The latest build of namespace-lister addresses this issue. Signed-off-by: Andy Sadler <[email protected]>
1 parent 2a31801 commit f248957

File tree

2 files changed

+9
-1
lines changed

2 files changed

+9
-1
lines changed

Diff for: components/namespace-lister/base/kustomization.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ namespace: namespace-lister
1313
images:
1414
- name: namespace-lister
1515
newName: quay.io/konflux-ci/namespace-lister
16-
newTag: 7f96fde10f2612c324fdafe4b1d73b6949ccbcba
16+
newTag: 7fdd5035064ffb27d1337ecffce42752f23f2548
1717
patches:
1818
- path: ./patches/with_cachenamespacelabelselector.yaml
1919
target:

Diff for: components/namespace-lister/base/rbac.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -34,3 +34,11 @@ rules:
3434
- roles
3535
- rolebindings
3636
verbs: ["get", "list", "watch"]
37+
- apiGroups: ["authentication.k8s.io"]
38+
resources:
39+
- tokenreviews
40+
verbs: ["create"]
41+
- apiGroups: ["authorization.k8s.io"]
42+
resources:
43+
- subjectaccessreviews
44+
verbs: ["create"]

0 commit comments

Comments
 (0)