Skip to content

✨ (go/v4): feat/fix: enhance cert-manager integration for metrics endpoints (follow-up to PR #4243)#4400

Merged
k8s-ci-robot merged 1 commit intokubernetes-sigs:masterfrom
camilamacedo86:protect-metrics-production
Dec 18, 2024
Merged

✨ (go/v4): feat/fix: enhance cert-manager integration for metrics endpoints (follow-up to PR #4243)#4400
k8s-ci-robot merged 1 commit intokubernetes-sigs:masterfrom
camilamacedo86:protect-metrics-production

Conversation

@camilamacedo86
Copy link
Copy Markdown
Member

@camilamacedo86 camilamacedo86 commented Dec 1, 2024

feat/fix: enhance cert-manager integration for metrics endpoints

This commit is a follow-up to PR #4243, which introduced support for using cert-manager certificates for securing the metrics endpoint and ServiceMonitor. Related to #3871 and #4003

Key enhancements:

  • Added support for configuring certificate integration via a Kustomize patch.
  • Introduced configurable flags for greater flexibility in customization.
  • Use Certwatcher to allow certificate rotation

This configuration provides an option for users to be production-ready.

These improvements enhance usability and adaptability while maintaining compatibility with the initial implementation. As the feature has not yet been released, this update ensures a polished and user-friendly integration for upcoming releases.

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. approved Indicates a PR has been approved by an approver from all required OWNERS files. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Dec 1, 2024
@camilamacedo86 camilamacedo86 changed the title Follow up of: #4243 - Ensure that production configuration to protect… feat: Add Kustomize patch and flags for metrics certificates configuration Dec 1, 2024
@camilamacedo86 camilamacedo86 changed the title feat: Add Kustomize patch and flags for metrics certificates configuration ✨ feat/fix: enhance cert-manager integration for metrics endpoints (follow-up to PR #4243) Dec 1, 2024
@camilamacedo86 camilamacedo86 force-pushed the protect-metrics-production branch from 167e3cf to 5e02482 Compare December 1, 2024 17:14
@k8s-ci-robot k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Dec 1, 2024
@camilamacedo86 camilamacedo86 force-pushed the protect-metrics-production branch from 5e02482 to a53d785 Compare December 1, 2024 17:20
@camilamacedo86 camilamacedo86 changed the title ✨ feat/fix: enhance cert-manager integration for metrics endpoints (follow-up to PR #4243) WIP: ✨ feat/fix: enhance cert-manager integration for metrics endpoints (follow-up to PR #4243) Dec 1, 2024
@k8s-ci-robot k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 1, 2024
@camilamacedo86 camilamacedo86 added release-blocker and removed do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Dec 1, 2024
@camilamacedo86 camilamacedo86 force-pushed the protect-metrics-production branch 3 times, most recently from 2f012e8 to fe0b824 Compare December 1, 2024 17:52
@k8s-ci-robot k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Dec 1, 2024
@camilamacedo86 camilamacedo86 force-pushed the protect-metrics-production branch 2 times, most recently from 6114658 to 7bcaf26 Compare December 1, 2024 18:51
@k8s-ci-robot k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Dec 1, 2024
@camilamacedo86 camilamacedo86 force-pushed the protect-metrics-production branch from 7bcaf26 to 323eb3e Compare December 1, 2024 19:06
@k8s-ci-robot k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 1, 2024
@camilamacedo86 camilamacedo86 changed the title WIP: ✨ feat/fix: enhance cert-manager integration for metrics endpoints (follow-up to PR #4243) ✨ feat/fix: enhance cert-manager integration for metrics endpoints (follow-up to PR #4243) Dec 1, 2024
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 1, 2024
@camilamacedo86 camilamacedo86 added priority/backlog Higher priority than priority/awaiting-more-evidence. and removed priority/backlog Higher priority than priority/awaiting-more-evidence. labels Dec 1, 2024
@camilamacedo86 camilamacedo86 force-pushed the protect-metrics-production branch 14 times, most recently from 02212a9 to 3f9defb Compare December 13, 2024 09:52
@camilamacedo86 camilamacedo86 changed the title WIP ✨ feat/fix: enhance cert-manager integration for metrics endpoints (follow-up to PR #4243) ✨ feat/fix: enhance cert-manager integration for metrics endpoints (follow-up to PR #4243) Dec 13, 2024
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 13, 2024
Copy link
Copy Markdown
Member

@damsien damsien left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small typo in the comment

@camilamacedo86
Copy link
Copy Markdown
Member Author

HI @damsien

All done! thx.

readOnly: true
- op: add
path: /spec/template/spec/containers/0/ports
value: []
Copy link
Copy Markdown
Member Author

@camilamacedo86 camilamacedo86 Dec 16, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we introduced it here: #4429
But when we try to have metrics or webhooks both
It will overwrite the values :-(
So, we cannot have that.

…low-up to PR kubernetes-sigs#4243)

This commit is a follow-up to PR kubernetes-sigs#4243, which introduced support for using cert-manager certificates for securing the metrics endpoint and ServiceMonitor. Related to kubernetes-sigs#3871 and kubernetes-sigs#4003

Key enhancements:
- Added support for configuring certificate integration via a Kustomize patch.
- Introduced configurable flags for greater flexibility in customization.
- Use Certwatcher to allow certificate rotation

These improvements enhance usability and adaptability while maintaining compatibility with the initial implementation. As the feature has not yet been released, this update ensures a polished and user-friendly integration for upcoming releases.

//nolint:lll
// nolint:lll
// nolint:lll
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should it be doubled ?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No should be only one :-)
good catcher

Copy link
Copy Markdown
Member

@varshaprasad96 varshaprasad96 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@k8s-ci-robot
Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: camilamacedo86, grzesuav, varshaprasad96

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [camilamacedo86,varshaprasad96]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-blocker size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants