Fix operator ports for metrics endpoint

Makefile

@@ -175,7 +175,14 @@ bundle: regenerate $(KUSTOMIZE)
 	cp bundle/manifests/logging.openshift.io_elasticsearches.yaml  manifests/${LOGGING_VERSION}/logging.openshift.io_elasticsearches_crd.yaml
 	cp bundle/manifests/logging.openshift.io_kibanas.yaml  manifests/${LOGGING_VERSION}/logging.openshift.io_kibanas_crd.yaml
 	cp bundle/manifests/elasticsearch-operator-metrics-monitor_monitoring.coreos.com_v1_servicemonitor.yaml  manifests/${LOGGING_VERSION}/
-	cp bundle/manifests/elasticsearch-operator-metrics-service_v1_service.yaml  manifests/${LOGGING_VERSION}/
+	cp bundle/manifests/elasticsearch-operator-metrics_v1_service.yaml  manifests/${LOGGING_VERSION}/
+	cp bundle/manifests/leader-election-role_rbac.authorization.k8s.io_v1_role.yaml manifests/${LOGGING_VERSION}/
+	cp bundle/manifests/leader-election-rolebinding_rbac.authorization.k8s.io_v1_rolebinding.yaml manifests/${LOGGING_VERSION}/
+	cp bundle/manifests/metrics-reader_rbac.authorization.k8s.io_v1beta1_clusterrole.yaml manifests/${LOGGING_VERSION}/
+	cp bundle/manifests/proxy-role_rbac.authorization.k8s.io_v1_clusterrole.yaml manifests/${LOGGING_VERSION}/
+	cp bundle/manifests/proxy-rolebinding_rbac.authorization.k8s.io_v1_clusterrolebinding.yaml manifests/${LOGGING_VERSION}/
+	cp bundle/manifests/prometheus_rbac.authorization.k8s.io_v1_role.yaml manifests/${LOGGING_VERSION}/
+	cp bundle/manifests/prometheus_rbac.authorization.k8s.io_v1_rolebinding.yaml manifests/${LOGGING_VERSION}/
 .PHONY: bundle
 
 test-e2e-upgrade: 

bundle/manifests/elasticsearch-operator-metrics-monitor_monitoring.coreos.com_v1_servicemonitor.yaml

@@ -6,10 +6,15 @@ metadata:
   name: elasticsearch-operator-metrics-monitor
 spec:
   endpoints:
-  - interval: 1s
+  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    interval: 30s
     path: /metrics
-    port: http
-    scheme: http
+    scheme: https
+    scrapeTimeout: 10s
+    targetPort: 8443
+    tlsConfig:
+      caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+      serverName: elasticsearch-operator-metrics.openshift-operators-redhat.svc
   selector:
     matchLabels:
       name: elasticsearch-operator

bundle/manifests/elasticsearch-operator-metrics-service_v1_service.yaml → bundle/manifests/elasticsearch-operator-metrics_v1_service.yaml

@@ -1,18 +1,18 @@
 apiVersion: v1
 kind: Service
 metadata:
+  annotations:
+    service.beta.openshift.io/serving-cert-secret-name: elasticsearch-operator-metrics
   creationTimestamp: null
   labels:
     name: elasticsearch-operator
-  name: elasticsearch-operator-metrics-service
+  name: elasticsearch-operator-metrics
 spec:
   ports:
-  - name: http
-    port: 8080
-    protocol: TCP
-    targetPort: 8080
+  - name: https
+    port: 8443
+    targetPort: https
   selector:
     name: elasticsearch-operator
-  type: ClusterIP
 status:
   loadBalancer: {}

bundle/manifests/elasticsearch-operator.clusterserviceversion.yaml

@@ -413,6 +413,22 @@ spec:
                 name: elasticsearch-operator
             spec:
               containers:
+              - args:
+                - --secure-listen-address=0.0.0.0:8443
+                - --upstream=http://127.0.0.1:8080/
+                - --logtostderr=true
+                - --tls-cert-file=/var/run/secrets/serving-cert/tls.crt
+                - --tls-private-key-file=/var/run/secrets/serving-cert/tls.key
+                - --v=2
+                image: gcr.io/kubebuilder/kube-rbac-proxy:v0.5.0
+                name: kube-rbac-proxy
+                ports:
+                - containerPort: 8443
+                  name: https
+                resources: {}
+                volumeMounts:
+                - mountPath: /var/run/secrets/serving-cert
+                  name: elasticsearch-operator-metrics-cert
               - command:
                 - elasticsearch-operator
                 env:
@@ -438,8 +454,8 @@ spec:
                 imagePullPolicy: IfNotPresent
                 name: elasticsearch-operator
                 ports:
-                - containerPort: 60000
-                  name: metrics
+                - containerPort: 8080
+                  name: http
                 resources:
                   limits:
                     cpu: 200m
@@ -450,6 +466,12 @@ spec:
               nodeSelector:
                 kubernetes.io/os: linux
               serviceAccountName: elasticsearch-operator
+              volumes:
+              - name: elasticsearch-operator-metrics-cert
+                secret:
+                  defaultMode: 420
+                  optional: true
+                  secretName: elasticsearch-operator-metrics
     strategy: deployment
   installModes:
   - supported: true

bundle/manifests/metrics-reader_rbac.authorization.k8s.io_v1beta1_clusterrole.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  labels:
+    name: elasticsearch-operator
+  name: metrics-reader
+rules:
+- nonResourceURLs:
+  - /metrics
+  verbs:
+  - get

bundle/manifests/prometheus_rbac.authorization.k8s.io_v1_role.yaml

@@ -0,0 +1,21 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations:
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  creationTimestamp: null
+  labels:
+    name: elasticsearch-operator
+  name: prometheus
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  - endpoints
+  - pods
+  verbs:
+  - get
+  - list
+  - watch

bundle/manifests/prometheus_rbac.authorization.k8s.io_v1_rolebinding.yaml

@@ -0,0 +1,18 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations:
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  creationTimestamp: null
+  labels:
+    name: elasticsearch-operator
+  name: prometheus
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: prometheus
+subjects:
+- kind: ServiceAccount
+  name: prometheus-k8s
+  namespace: openshift-monitoring

bundle/manifests/proxy-role_rbac.authorization.k8s.io_v1_clusterrole.yaml

@@ -0,0 +1,20 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  labels:
+    name: elasticsearch-operator
+  name: proxy-role
+rules:
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create

bundle/manifests/proxy-rolebinding_rbac.authorization.k8s.io_v1_clusterrolebinding.yaml

@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  creationTimestamp: null
+  labels:
+    name: elasticsearch-operator
+  name: proxy-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: proxy-role
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: openshift-operators-redhat

config/default/kustomization.yaml

@@ -16,10 +16,10 @@ bases:
 - ../crd
 - ../rbac
 - ../manager
-# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
 - ../prometheus
 
 patchesStrategicMerge:
+- manager_auth_proxy_patch.yaml
 
 # the following config is for teaching kustomize how to do var substitution
 vars:

config/default/manager_auth_proxy_patch.yaml

@@ -0,0 +1,32 @@
+# This patch inject a sidecar container which is a HTTP proxy for the
+# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: elasticsearch-operator
+  labels:
+spec:
+  template:
+    spec:
+      containers:
+      - name: kube-rbac-proxy
+        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.5.0
+        args:
+        - "--secure-listen-address=0.0.0.0:8443"
+        - "--upstream=http://127.0.0.1:8080/"
+        - "--logtostderr=true"
+        - "--tls-cert-file=/var/run/secrets/serving-cert/tls.crt"
+        - "--tls-private-key-file=/var/run/secrets/serving-cert/tls.key"
+        - "--v=2"
+        ports:
+        - containerPort: 8443
+          name: https
+        volumeMounts:
+        - mountPath: /var/run/secrets/serving-cert
+          name: elasticsearch-operator-metrics-cert
+      volumes:
+      - name: elasticsearch-operator-metrics-cert
+        secret:
+          defaultMode: 420
+          optional: true
+          secretName: elasticsearch-operator-metrics

config/manager/manager.yaml

@@ -18,8 +18,8 @@ spec:
       - command:
         - elasticsearch-operator
         ports:
-        - containerPort: 60000
-          name: metrics
+        - containerPort: 8080
+          name: http
         image: quay.io/openshift/origin-elasticsearch-operator:latest
         name: elasticsearch-operator
         imagePullPolicy: IfNotPresent

config/prometheus/kustomization.yaml

@@ -1,3 +1,2 @@
 resources:
 - monitor.yaml
-- service.yaml

config/prometheus/monitor.yaml

@@ -8,10 +8,15 @@ metadata:
   name: elasticsearch-operator-metrics-monitor
 spec:
   endpoints:
-    - path: /metrics
-      port: http
-      scheme: http
-      interval: 1s
+    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+      path: /metrics
+      targetPort: 8443
+      scheme: https
+      interval: 30s
+      scrapeTimeout: 10s
+      tlsConfig:
+        caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+        serverName: elasticsearch-operator-metrics.openshift-operators-redhat.svc
   selector:
     matchLabels:
-      name: elasticsearch-operator
+      name: elasticsearch-operator

config/rbac/auth_proxy_service.yaml

@@ -1,14 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
+  annotations:
+    service.beta.openshift.io/serving-cert-secret-name: elasticsearch-operator-metrics
   labels:
-    control-plane: controller-manager
-  name: controller-manager-metrics-service
-  namespace: system
+    name: elasticsearch-operator
+  name: elasticsearch-operator-metrics
 spec:
   ports:
   - name: https
     port: 8443
     targetPort: https
   selector:
-    control-plane: controller-manager
+    name: elasticsearch-operator

config/rbac/kustomization.yaml

@@ -3,10 +3,9 @@ resources:
 - role_binding.yaml
 - leader_election_role.yaml
 - leader_election_role_binding.yaml
-# Comment the following 4 lines if you want to disable
-# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
-# which protects your /metrics endpoint.
-#- auth_proxy_service.yaml
-#- auth_proxy_role.yaml
-#- auth_proxy_role_binding.yaml
-#- auth_proxy_client_clusterrole.yaml
+- auth_proxy_service.yaml
+- auth_proxy_role.yaml
+- auth_proxy_role_binding.yaml
+- auth_proxy_client_clusterrole.yaml
+- prometheus_role.yaml
+- prometheus_role_binding.yaml

config/rbac/prometheus_role.yaml

@@ -0,0 +1,18 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations:
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+  name: prometheus
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  - endpoints
+  - pods
+  verbs:
+  - get
+  - list
+  - watch

config/rbac/prometheus_role_binding.yaml

@@ -0,0 +1,16 @@
+# Grant cluster-monitoring access to openshift-operators-redhat metrics
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: prometheus
+  annotations:
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: prometheus
+subjects:
+- kind: ServiceAccount
+  name: prometheus-k8s
+  namespace: openshift-monitoring

manifests/5.1/elasticsearch-operator-metrics-monitor_monitoring.coreos.com_v1_servicemonitor.yaml

@@ -6,10 +6,15 @@ metadata:
   name: elasticsearch-operator-metrics-monitor
 spec:
   endpoints:
-  - interval: 1s
+  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    interval: 30s
     path: /metrics
-    port: http
-    scheme: http
+    scheme: https
+    scrapeTimeout: 10s
+    targetPort: 8443
+    tlsConfig:
+      caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+      serverName: elasticsearch-operator-metrics.openshift-operators-redhat.svc
   selector:
     matchLabels:
       name: elasticsearch-operator