-
Notifications
You must be signed in to change notification settings - Fork 600
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Turn https and authn/authz filter on for metrics port. Add RBAC to al…
…low pgo service account to authenticate and authorize requests to metrics server.
- Loading branch information
Showing
5 changed files
with
78 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,6 +6,7 @@ package main | |
|
|
||
| import ( | ||
| "context" | ||
| "crypto/tls" | ||
| "errors" | ||
| "fmt" | ||
| "net/http" | ||
|
|
@@ -20,6 +21,7 @@ import ( | |
| "k8s.io/apimachinery/pkg/util/validation" | ||
| "k8s.io/client-go/rest" | ||
| "sigs.k8s.io/controller-runtime/pkg/healthz" | ||
| "sigs.k8s.io/controller-runtime/pkg/metrics/filters" | ||
|
|
||
| "github.com/crunchydata/postgres-operator/internal/bridge" | ||
| "github.com/crunchydata/postgres-operator/internal/bridge/crunchybridgecluster" | ||
|
|
@@ -58,13 +60,37 @@ func initLogging() { | |
| } | ||
|
|
||
| //+kubebuilder:rbac:groups="coordination.k8s.io",resources="leases",verbs={get,create,update,watch} | ||
| //+kubebuilder:rbac:groups="authentication.k8s.io",resources="tokenreviews",verbs={create} | ||
| //+kubebuilder:rbac:groups="authorization.k8s.io",resources="subjectaccessreviews",verbs={create} | ||
|
|
||
| func initManager(ctx context.Context) (runtime.Options, error) { | ||
| log := logging.FromContext(ctx) | ||
|
|
||
| options := runtime.Options{} | ||
| options.Cache.SyncPeriod = initialize.Pointer(time.Hour) | ||
|
|
||
| // If we aren't using it, http/2 should be disabled | ||
| // due to its vulnerabilities. More specifically, disabling http/2 will | ||
| // prevent from being vulnerable to the HTTP/2 Stream Cancellation and | ||
| // Rapid Reset CVEs. For more information see: | ||
| // - https://github.com/advisories/GHSA-qppj-fm5r-hxr3 | ||
| // - https://github.com/advisories/GHSA-4374-p667-p6c8 | ||
| options.Metrics.TLSOpts = append(options.Metrics.TLSOpts, func(c *tls.Config) { | ||
| log.Info("enabling metrics via http/1.1") | ||
| c.NextProtos = []string{"http/1.1"} | ||
| }) | ||
|
|
||
| // Use https port | ||
| options.Metrics.BindAddress = ":8443" | ||
| options.Metrics.SecureServing = true | ||
|
|
||
| // FilterProvider is used to protect the metrics endpoint with authn/authz. | ||
| // These configurations ensure that only authorized users and service accounts | ||
| // can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info: | ||
| // https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization | ||
| options.Metrics.FilterProvider = filters.WithAuthenticationAndAuthorization | ||
|
|
||
| // Set health probe port | ||
| options.HealthProbeBindAddress = ":8081" | ||
|
|
||
| // Enable leader elections when configured with a valid Lease.coordination.k8s.io name. | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters