opendatahub-io / trainer / 31708712076

67%

main: 67%

Pull #206

github

feat: enable SecureServing, TLS profile watcher, and cert provisioning

Enable HTTPS on the controller-runtime metrics endpoint with authn/authz
via FilterProvider, add a TLS profile watcher for live OpenShift
TLSSecurityProfile change detection, and migrate OpenShift-specific RBAC
to overlay.

Metrics TLS cert:

The metrics server was falling back to a self-signed localhost cert
because cert-controller writes webhook certs to /tmp after manager
startup. MetricsTLSOpt() fixes this with a lazy GetCertificate hook that
retries certwatcher initialisation on each TLS handshake until the files
exist. Tests cover three cases: missing files, files present on first
call, and retry-until-available.

Prometheus scraping:

- Switch monitor.yaml from PodMonitor to ServiceMonitor. The PodMonitor
  v1 CRD in OpenShift dropped bearerTokenFile, so Prometheus was sending
  unauthenticated requests and getting 401. ServiceMonitor v1 still
  supports bearerTokenFile.
- Add metrics-reader ClusterRole/ClusterRoleBinding granting the
  prometheus-k8s SA access to /metrics (required for the SAR check in
  WithAuthenticationAndAuthorization).
- Make the TLS serverName configurable via params.env so it stays correct
  when the operator is deployed to a different namespace (opendatahub for
  ODH, redhat-ods-applications for RHOAI).

All CLI cert flags removed; SecureServing comes from config, cert wiring
via MetricsTLSOpt().

Live-tested on ugiordan.7bcr: Prometheus target health goes from
"down | tls: certificate is valid for localhost" to "up" with 562
samples per scrape.

Co-Authored-By: Claude <claude-sonnet-4-6> <noreply@anthropic.com>
Signed-off-by: Ugo Giordano <ugiordan@redhat.com>

61 of 99 new or added lines in 3 files covered. (61.62%)

3080 of 4613 relevant lines covered (66.77%)

0.78 hits per line