Bug 1896923: Configure CoreDNS metrics plugin to use localhost #210

Miciah · 2020-11-11T22:21:17Z

Configure the operator's metrics handler and the CoreDNS metrics plugin to listen on 127.0.0.1 only.

Before this change, metrics were exposed on ports 9153 and 60000, without authentication. Although the pod spec does not advertise ports 9153 or 60000, the ports were still accessible outside the pod. After this change, ports 9153 and 60000 are inaccessible outside the pod, so the only way to get metrics is by connecting to port 9154 (for CoreDNS metrics) or port 9393 (for operator metrics) and authenticating with kube-rbac-proxy.

cmd/dns-operator/main.go (main): Configure metrics to listen on 127.0.0.1:60000.
pkg/operator/controller/controller_dns_configmap.go (corefileTemplate): Configure metrics to listen on 127.0.0.1:9153.
pkg/operator/controller/controller_dns_configmap_test.go (TestDesiredDNSConfigmap): Update the expected Corefile accordingly.

openshift-ci-robot · 2020-11-11T22:21:23Z

@Miciah: This pull request references Bugzilla bug 1896923, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.7.0) matches configured target release for branch (4.7.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1896923: Configure CoreDNS metrics plugin to use localhost

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sgreene570 · 2020-11-12T14:42:57Z

@Miciah should this PR also configure the operator to use localhost:60000 instead of :60000 for it's own metrics address in cmd/dns-operator/main.go (as per the BZ description)?

Configure the operator's metrics handler and the CoreDNS metrics plugin to listen on 127.0.0.1 only. Before this commit, metrics were exposed on ports 9153 and 60000, without authentication. Although the pod spec does not advertise ports 9153 or 60000, the ports were still accessible outside the pod. After this commit, ports 9153 and 60000 are inaccessible outside the pod, so the only way to get metrics is by connecting to port 9154 (for CoreDNS metrics) or port 9393 (for operator metrics) and authenticating with kube-rbac-proxy. This commit fixes bug 1896923. https://bugzilla.redhat.com/show_bug.cgi?id=1896923 * cmd/dns-operator/main.go (main): Configure metrics to listen on 127.0.0.1:60000. * pkg/operator/controller/controller_dns_configmap.go (corefileTemplate): Configure metrics to listen on 127.0.0.1:9153. * pkg/operator/controller/controller_dns_configmap_test.go (TestDesiredDNSConfigmap): Update the expected Corefile accordingly.

openshift-ci-robot · 2020-11-12T23:10:43Z

@Miciah: This pull request references Bugzilla bug 1896923, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.7.0) matches configured target release for branch (4.7.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1896923: Configure CoreDNS metrics plugin to use localhost

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Miciah · 2020-11-12T23:12:17Z

@Miciah should this PR also configure the operator to use localhost:60000 instead of :60000 for it's own metrics address in cmd/dns-operator/main.go (as per the BZ description)?

Fixed. Thanks!

sgreene570 · 2020-11-13T14:36:55Z

/retest

sgreene570 · 2020-11-13T15:44:58Z

/lgtm

openshift-ci-robot · 2020-11-13T15:45:20Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Miciah, sgreene570

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Miciah,sgreene570]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2020-11-13T19:19:37Z

/retest