UPSTREAM: <carry>: OCPBUGS-90506: add secure metrics serving with TokenReview/SAR authentication by Thealisyed · Pull Request #200 · openshift/external-dns

Thealisyed · 2026-08-13T10:13:54Z

Summary

Adds --metrics-tls-cert-dir flag (directory containing tls.crt and tls.key provisioned by service-ca); defaults to empty string (plain HTTP) for backward compatibility
Implements withMetricsAuth using k8s.io/client-go directly — zero new dependencies
All new code lives in metrics_openshift.go / metrics_openshift_test.go to minimise the carry patch diff in main.go
/healthz remains unauthenticated for kubelet liveness/readiness probes
Operator side (removing the sidecar injection, updating Service/ServiceMonitor ports) tracked in openshift/external-dns-operator by @rfredette

Note:

Operator-side PR (removing kube-rbac-proxy sidecar, updating Service/ServiceMonitor) by @rfredette: must coordinate port changes before merging

openshift-ci-robot · 2026-08-13T10:14:01Z

@Thealisyed: This pull request references Jira Issue OCPBUGS-90506, which is invalid:

expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Replaces the kube-rbac-proxy sidecar with inline TokenReview/SAR authentication served directly by the external-dns binary

Adds --metrics-tls-cert-dir flag (directory containing tls.crt and tls.key provisioned by service-ca); defaults to empty string (plain HTTP) for backward compatibility

Implements authMiddleware using k8s.io/client-go directly — zero new dependencies

/healthz remains unauthenticated for kubelet liveness/readiness probes

Operator side (removing the sidecar injection, updating Service/ServiceMonitor ports) tracked in openshift/external-dns-operator by @rfredette

Why not filters.WithAuthenticationAndAuthorization from controller-runtime?

That function imports k8s.io/apiserver which is not in external-dns's dependency tree. The inline client-go implementation is functionally identical with no new transitive deps.

Dependencies

Operator-side PR (removing kube-rbac-proxy sidecar, updating Service/ServiceMonitor) by @rfredette — must coordinate port changes before merging

Test plan

Unit tests for authMiddleware covering: no header, non-bearer scheme, TokenReview API error, unauthenticated token, SAR API error, SAR denied, and authorized pass-through

Unit test verifying correct user/groups/NonResourceAttributes are forwarded to SAR

E2E: deploy with --metrics-tls-cert-dir set, confirm Prometheus scrapes successfully

E2E: deploy without flag, confirm plain HTTP metrics still work (backward compat)

Fixes: https://issues.redhat.com/browse/OCPBUGS-90506

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Thealisyed · 2026-08-18T10:06:52Z

/jira refresh

openshift-ci-robot · 2026-08-18T10:06:56Z

@Thealisyed: This pull request references Jira Issue OCPBUGS-90506, which is invalid:

expected the bug to target either version "5.1.0." or "openshift-5.1.0.", but it targets "5.0.0" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Thealisyed · 2026-08-18T10:07:18Z

/jira refresh

openshift-ci-robot · 2026-08-18T10:07:25Z

@Thealisyed: This pull request references Jira Issue OCPBUGS-90506, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.1.0) matches configured target version for branch (5.1.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @melvinjoseph86

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Expose ExternalDNS operand metrics to cluster Prometheus without using a kube-rbac-proxy sidecar. The operand now serves its own metrics over HTTPS with Kubernetes TokenReview/SAR auth via --metrics-tls-cert-dir (added in openshift/external-dns#200). - Add --metrics-tls-cert-dir arg and service-ca cert volume mount to each ExternalDNS container - Change --metrics-address from 127.0.0.1 to 0.0.0.0 so metrics are reachable outside the pod - Create a Service with serving-cert annotation for auto TLS - Create a ServiceMonitor for Prometheus discovery (HTTPS, port 7979+) - Add tokenreviews/subjectaccessreviews RBAC for the operand service account Depends on openshift/external-dns#200 for the operand-side auth layer. Assisted with Claude.

alebedev87 · 2026-08-19T12:38:21Z

/assign

alebedev87

The main approach LGTM, some remarks about minimizing the impact of the carrying the patch. Also, about the commit message and PR title - kube-rbac-proxy doesn't figure in external-dns context, it's something we add in the operator. Something like add secure metrics serving with TokenReview/SAR authentication would be more fitting into the context.

…enReview/SAR authentication

openshift-ci · 2026-08-26T10:45:02Z

@Thealisyed: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

alebedev87 · 2026-08-26T11:04:29Z

/approve
/lgtm

openshift-ci · 2026-08-26T11:04:55Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alebedev87

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~DOWNSTREAM_OWNERS~~ [alebedev87]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2026-08-26T11:07:18Z

@Thealisyed: Jira Issue OCPBUGS-90506: Some pull requests linked via external trackers have merged:

openshift/external-dns#200

The following pull request, linked via external tracker, has not merged:

openshift/external-dns-operator#502 is open

All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-90506 has not been moved to the MODIFIED state.

Details

In response to this:

Summary

Replaces the kube-rbac-proxy sidecar with inline TokenReview/SAR authentication served directly by the external-dns binary

Adds --metrics-tls-cert-dir flag (directory containing tls.crt and tls.key provisioned by service-ca); defaults to empty string (plain HTTP) for backward compatibility

Implements authMiddleware using k8s.io/client-go directly — zero new dependencies

/healthz remains unauthenticated for kubelet liveness/readiness probes

Operator side (removing the sidecar injection, updating Service/ServiceMonitor ports) tracked in openshift/external-dns-operator by @rfredette

Note:

Operator-side PR (removing kube-rbac-proxy sidecar, updating Service/ServiceMonitor) by @rfredette: must coordinate port changes before merging

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-08-26T14:08:21Z

@Thealisyed: Jira Issue OCPBUGS-90506: Some pull requests linked via external trackers have merged:

openshift/external-dns#200

The following pull request, linked via external tracker, has not merged:

openshift/external-dns-operator#502 is open

All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-90506 has not been moved to the MODIFIED state.

Details

In response to this:

Summary

Adds --metrics-tls-cert-dir flag (directory containing tls.crt and tls.key provisioned by service-ca); defaults to empty string (plain HTTP) for backward compatibility

Implements withMetricsAuth using k8s.io/client-go directly — zero new dependencies

All new code lives in metrics_openshift.go / metrics_openshift_test.go to minimise the carry patch diff in main.go

/healthz remains unauthenticated for kubelet liveness/readiness probes

Operator side (removing the sidecar injection, updating Service/ServiceMonitor ports) tracked in openshift/external-dns-operator by @rfredette

Note:

Operator-side PR (removing kube-rbac-proxy sidecar, updating Service/ServiceMonitor) by @rfredette: must coordinate port changes before merging

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 13, 2026

openshift-ci Bot requested review from grzpiotrowski and rikatz August 13, 2026 10:14

Thealisyed force-pushed the OCPBUGS-90506-native-metrics-auth branch from cb3ef99 to 84286dd Compare August 13, 2026 10:18

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Aug 18, 2026

openshift-ci Bot requested a review from melvinjoseph86 August 18, 2026 10:07

Thealisyed changed the title ~~[WIP] UPSTREAM: <carry>: OCPBUGS-90506: replace kube-rbac-proxy with native metrics auth~~ UPSTREAM: <carry>: OCPBUGS-90506: replace kube-rbac-proxy with native metrics auth Aug 18, 2026

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 18, 2026

Thealisyed force-pushed the OCPBUGS-90506-native-metrics-auth branch from 84286dd to 729bf5d Compare August 18, 2026 11:02

Thealisyed mentioned this pull request Aug 18, 2026

OCPBUGS-58102: Expose ExternalDNS operand metrics via kube-rbac-proxy sidecar openshift/external-dns-operator#371

Open

openshift-ci Bot assigned alebedev87 Aug 19, 2026

alebedev87 reviewed Aug 19, 2026

View reviewed changes

Comment thread main.go Outdated

Comment thread main.go Outdated

Comment thread main.go Outdated

Thealisyed changed the title ~~UPSTREAM: <carry>: OCPBUGS-90506: replace kube-rbac-proxy with native metrics auth~~ UPSTREAM: <carry>: OCPBUGS-90506: add secure metrics serving with TokenReview/SAR authentication Aug 25, 2026

Thealisyed force-pushed the OCPBUGS-90506-native-metrics-auth branch from 729bf5d to 8109021 Compare August 25, 2026 13:12

alebedev87 reviewed Aug 25, 2026

View reviewed changes

Comment thread metrics_openshift_test.go Outdated

UPSTREAM: <carry>: OCPBUGS-90506: add secure metrics serving with Tok…

9c589ae

…enReview/SAR authentication

Thealisyed force-pushed the OCPBUGS-90506-native-metrics-auth branch from 8109021 to 9c589ae Compare August 26, 2026 10:36

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 26, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 26, 2026

openshift-merge-bot Bot merged commit e9cddd3 into openshift:master Aug 26, 2026
4 checks passed

This was referenced Aug 29, 2026

OCPBUGS-90506: Update external-dns-container-ext-dns-optr-1-3-rhel-9 to 9e02d30 openshift/external-dns-operator#564

Merged

OCPBUGS-90506: Replace kube-rbac-proxy sidecar with controller-runtime FilterProvider openshift/external-dns-operator#502

Merged

Uh oh!

Conversation

Thealisyed commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Note:

Uh oh!

openshift-ci-robot commented Aug 13, 2026

Summary

Why not filters.WithAuthenticationAndAuthorization from controller-runtime?

Dependencies

Test plan

Uh oh!

Thealisyed commented Aug 18, 2026

Uh oh!

openshift-ci-robot commented Aug 18, 2026

Uh oh!

Thealisyed commented Aug 18, 2026

Uh oh!

openshift-ci-robot commented Aug 18, 2026

Uh oh!

alebedev87 commented Aug 19, 2026

Uh oh!

alebedev87 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

alebedev87 commented Aug 26, 2026

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Aug 26, 2026

Summary

Note:

Uh oh!

openshift-ci-robot commented Aug 26, 2026

Summary

Note:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Thealisyed commented Aug 13, 2026 •

edited

Loading

Why not `filters.WithAuthenticationAndAuthorization` from controller-runtime?