16304573038

Committed 15 Jul 2025 09:19PM UTC coverage: 75.124% (-0.05%) from 75.17%

Build # 16304573038

Build Type

push

github

Committed by

web-flow

Commit Message

Secure the metrics endpoint with https (#3627)

While working on network policies, it appears that network policies do
not work with named ports (e.g. "metrics"), but need the port number of
the pod.

The majority of the pods in KubeVirt project, uses port 8443, so we must
align with them to be able to use the same network policies.

But moving to port 8443 also requires using https instead of http.

This PR changes the protocol of the metrics endpoint to https, and the
port to 8443, both in the operator and the webhook.

Signed-off-by: Nahshon Unna-Tsameret <nunnatsa@redhat.com>

Run Details

16 of 25 new or added lines in 3 files covered. (64.0%)

6523 of 8683 relevant lines covered (75.12%)

1.74 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/pkg/authorization/http.go

package authorization

import (
        "net/http"
        "strings"

        "github.com/go-logr/logr"
        "k8s.io/client-go/rest"
        "sigs.k8s.io/controller-runtime/pkg/metrics/server"
)

func HttpWithBearerToken(_ *rest.Config, _ *http.Client) (server.Filter, error) {
        return func(log logr.Logger, handler http.Handler) (http.Handler, error) {
                return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
                        authValue := req.Header.Get("Authorization")
                        token := strings.TrimPrefix(authValue, "Bearer ")

                        if token == "" {
                                http.Error(w, "Unauthorized", http.StatusUnauthorized)
                                return
                        }

                        valid, err := ValidateToken(token)
                        if err != nil || !valid {
                                http.Error(w, "Unauthorized", http.StatusUnauthorized)
                                return
                        }

                        handler.ServeHTTP(w, req)
                }), nil
        }, nil
}

1	package authorization
2
3	import (
4	"net/http"
5	"strings"
6
7	"github.com/go-logr/logr"
8	"k8s.io/client-go/rest"
9	"sigs.k8s.io/controller-runtime/pkg/metrics/server"
10	)
11
NEW 12	func HttpWithBearerToken(_ rest.Config, _ http.Client) (server.Filter, error) {	×
13	return func(log logr.Logger, handler http.Handler) (http.Handler, error) {	×
14	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {	×
15	authValue := req.Header.Get("Authorization")	×
16	token := strings.TrimPrefix(authValue, "Bearer ")	×
17		×
18	if token == "" {	×
19	http.Error(w, "Unauthorized", http.StatusUnauthorized)	×
20	return	×
21	}	×
22
23	valid, err := ValidateToken(token)	×
24	if err != nil \|\| !valid {	×
25	http.Error(w, "Unauthorized", http.StatusUnauthorized)	×
26	return	×
27	}	×
28
29	handler.ServeHTTP(w, req)	×
30	}), nil
31	}, nil
32	}

kubevirt / hyperconverged-cluster-operator / 16304573038

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous