kubeflow / trainer / 32304804390

68%

push

github

feat(controller): secure metrics endpoint with TLS and RBAC-based auth (#3912)

* fix(controller): wire webhook cert to metrics server to fix first-boot race

When secureServing is enabled, the manager's built-in metrics server was
being configured with TLS certificates at startup before the cert manager
goroutine had written them to disk. On the first boot this caused a TLS
handshake failure since the key/cert files didn't exist yet.

Fix the race by starting the metrics server inside setupManagerComponents,
after the certsReady channel fires. The manager's built-in metrics server
is always disabled (BindAddress="0") so it never races for the same port.
metricsserver.NewServer handles cert rotation internally, so no separate
certwatcher setup is needed.

Changes:
- pkg/metrics/setup.go: new SetupServer helper, always called from main
  regardless of SecureServing; uses tlsconfig.Apply for TLS options;
  metricsserver.NewServer handles cert rotation; returns nil when disabled
- pkg/config/config.go: always set BindAddress="0" to disable the
  manager's built-in metrics server; remove unused IsAuthenticatedMetricsEnabled
- cmd/trainer-controller-manager/main.go: always call metrics.SetupServer,
  remove SecureServing gate
- pkg/apis/config/v1alpha1/configuration_types.go: replace flat
  AuthenticatedMetrics *bool with Auth *MetricsAuthConfig nested struct
- pkg/apis/config/v1alpha1/defaults.go: initialise new Auth subobject
- pkg/apis/config/v1alpha1/zz_generated.deepcopy.go: regenerated
- pkg/config/config_test.go: update test fixtures for new Auth subobject
  and always-disabled built-in metrics server; fix stale comment
- Makefile: add ./pkg/metrics/... to controller-gen paths so RBAC markers
  in setup.go are picked up
- manifests/base/rbac/role.yaml: regenerated with tokenreviews and
  subjectaccessreviews rules
- go.mod/go.sum: bump k8s.io/streaming to v0.36.3 to match CI environment

Signed-off-by: Ugo Giordano <ugiordan@redhat.com>

* fix(metri... (continued)

4 of 33 new or added lines in 3 files covered. (12.12%)

2603 of 3802 relevant lines covered (68.46%)

0.8 hits per line