[release-4.8] Bug 2008414: pkg/operator/metriccontroller: read etcd-operator SA token rather than using prometheus

pkg/operator/metriccontroller/client.go

@@ -1,21 +1,16 @@
 package metriccontroller
 
 import (
-	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
 	"io/ioutil"
 	"net"
 	"net/http"
-	"strings"
 	"time"
 
 	prometheusapi "github.com/prometheus/client_golang/api"
 	prometheusv1 "github.com/prometheus/client_golang/api/prometheus/v1"
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	coreclientv1 "k8s.io/client-go/kubernetes/typed/core/v1"
 	"k8s.io/client-go/transport"
 )
 
@@ -41,31 +36,22 @@ func getTransport() (*http.Transport, error) {
 	}, nil
 }
 
-func getPrometheusClient(ctx context.Context, secretClient coreclientv1.SecretsGetter, httpTransport *http.Transport) (prometheusv1.API, error) {
-	secrets, err := secretClient.Secrets("openshift-monitoring").List(ctx, metav1.ListOptions{})
+func getPrometheusClient(httpTransport *http.Transport) (prometheusv1.API, error) {
+	saToken, err := ioutil.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/token")
 	if err != nil {
-		return nil, err
-	}
-	bearerToken := ""
-	for _, s := range secrets.Items {
-		if s.Type != corev1.SecretTypeServiceAccountToken ||
-			!strings.HasPrefix(s.Name, "prometheus-k8s") {
-			continue
-		}
-		bearerToken = string(s.Data[corev1.ServiceAccountTokenKey])
-		break
-	}
-	if len(bearerToken) == 0 {
-		return nil, fmt.Errorf("unable to retrieve prometheus-k8 bearer token")
+		return nil, fmt.Errorf("error reading service account token: %w", err)
 	}
 
 	client, err := prometheusapi.NewClient(prometheusapi.Config{
 		Address: "https://" + net.JoinHostPort("thanos-querier.openshift-monitoring.svc", "9091"),
 		RoundTripper: transport.NewBearerAuthRoundTripper(
-			bearerToken,
+			string(saToken),
 			httpTransport,
 		),
 	})
+	if err != nil {
+		return nil, fmt.Errorf("error creating prometheus client: %w", err)
+	}
 
 	return prometheusv1.NewAPI(client), nil
 }

pkg/operator/metriccontroller/fsync_controller.go

@@ -11,24 +11,20 @@ import (
 
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
 	"k8s.io/klog/v2"
 
 	configclientv1 "github.com/openshift/client-go/config/clientset/versioned/typed/config/v1"
 	"github.com/openshift/library-go/pkg/controller/factory"
 	"github.com/openshift/library-go/pkg/operator/events"
-	operatorv1helpers "github.com/openshift/library-go/pkg/operator/v1helpers"
 )
 
 type FSyncController struct {
-	secretClient corev1client.SecretsGetter
-	infraClient  configclientv1.InfrastructuresGetter
+	infraClient configclientv1.InfrastructuresGetter
 }
 
-func NewFSyncController(operatorClient operatorv1helpers.OperatorClient, infraClient configclientv1.InfrastructuresGetter, secretGetter corev1client.SecretsGetter, recorder events.Recorder) factory.Controller {
+func NewFSyncController(infraClient configclientv1.InfrastructuresGetter, recorder events.Recorder) factory.Controller {
 	c := &FSyncController{
-		secretClient: secretGetter,
-		infraClient:  infraClient,
+		infraClient: infraClient,
 	}
 	return factory.New().ResyncEvery(1*time.Minute).WithSync(c.sync).ToController("FSyncController", recorder)
 }
@@ -40,7 +36,7 @@ func (c *FSyncController) sync(ctx context.Context, syncCtx factory.SyncContext)
 	}
 	defer transport.CloseIdleConnections()
 
-	client, err := getPrometheusClient(ctx, c.secretClient, transport)
+	client, err := getPrometheusClient(transport)
 	if errors.IsNotFound(err) {
 		return nil
 	}

pkg/operator/starter.go

@@ -164,7 +164,7 @@ func RunOperator(ctx context.Context, controllerContext *controllercmd.Controlle
 		return err
 	}
 
-	fsyncMetricController := metriccontroller.NewFSyncController(operatorClient, configClient.ConfigV1(), kubeClient.CoreV1(), controllerContext.EventRecorder)
+	fsyncMetricController := metriccontroller.NewFSyncController(configClient.ConfigV1(), controllerContext.EventRecorder)
 
 	statusController := status.NewClusterOperatorStatusController(
 		"etcd",