diff --git a/Makefile b/Makefile index dccdbcca..f981ae85 100644 --- a/Makefile +++ b/Makefile @@ -390,7 +390,7 @@ $(RELEASE_DIR)/%: $(RELEASE_MANIFEST_INPUTS) .PHONY: release-manifests-metrics-port release-manifests-metrics-port: - make release-manifests RELEASE_MANIFEST_SOURCE_BASE=config/default-with-metrics-port + make release-manifests RELEASE_MANIFEST_SOURCE_BASE=config/default .PHONY: release-staging release-staging: ## Builds and push container images and manifests to the staging bucket. diff --git a/config/default-with-metrics-port/auth_proxy_client_clusterrole.yaml b/config/default-with-metrics-port/auth_proxy_client_clusterrole.yaml deleted file mode 100644 index 51a75db4..00000000 --- a/config/default-with-metrics-port/auth_proxy_client_clusterrole.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: metrics-reader -rules: -- nonResourceURLs: - - "/metrics" - verbs: - - get diff --git a/config/default-with-metrics-port/auth_proxy_role.yaml b/config/default-with-metrics-port/auth_proxy_role.yaml deleted file mode 100644 index 80e1857c..00000000 --- a/config/default-with-metrics-port/auth_proxy_role.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: proxy-role -rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create diff --git a/config/default-with-metrics-port/auth_proxy_role_binding.yaml b/config/default-with-metrics-port/auth_proxy_role_binding.yaml deleted file mode 100644 index ec7acc0a..00000000 --- a/config/default-with-metrics-port/auth_proxy_role_binding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: proxy-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: proxy-role -subjects: -- kind: ServiceAccount - name: controller-manager - namespace: system diff --git a/config/default-with-metrics-port/auth_proxy_service.yaml b/config/default-with-metrics-port/auth_proxy_service.yaml deleted file mode 100644 index dcb3b898..00000000 --- a/config/default-with-metrics-port/auth_proxy_service.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - control-plane: controller-manager - name: controller-manager-metrics-service - namespace: system -spec: - ports: - - name: https - port: 8443 - protocol: TCP - targetPort: https - selector: - control-plane: capc-controller-manager diff --git a/config/default-with-metrics-port/kustomization.yaml b/config/default-with-metrics-port/kustomization.yaml deleted file mode 100644 index 7811196a..00000000 --- a/config/default-with-metrics-port/kustomization.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -bases: -- ../default - -resources: -- auth_proxy_client_clusterrole.yaml -- auth_proxy_role.yaml -- auth_proxy_role_binding.yaml -- auth_proxy_service.yaml - -patchesStrategicMerge: - - manager_auth_proxy_patch.yaml \ No newline at end of file diff --git a/config/default-with-metrics-port/manager_auth_proxy_patch.yaml b/config/default-with-metrics-port/manager_auth_proxy_patch.yaml deleted file mode 100644 index d4f64817..00000000 --- a/config/default-with-metrics-port/manager_auth_proxy_patch.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# This patch inject a sidecar container which is a HTTP proxy for the -# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews. -apiVersion: apps/v1 -kind: Deployment -metadata: - name: controller-manager - namespace: system -spec: - template: - spec: - containers: - - name: kube-rbac-proxy - image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0 - args: - - "--secure-listen-address=0.0.0.0:8443" - - "--upstream=http://127.0.0.1:8080/" - - "--logtostderr=true" - - "--v=10" - ports: - - containerPort: 8443 - protocol: TCP - name: https diff --git a/config/default/manager_config_patch.yaml b/config/default/manager_config_patch.yaml deleted file mode 100644 index 6c400155..00000000 --- a/config/default/manager_config_patch.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: controller-manager - namespace: system -spec: - template: - spec: - containers: - - name: manager - args: - - "--config=controller_manager_config.yaml" - volumeMounts: - - name: manager-config - mountPath: /controller_manager_config.yaml - subPath: controller_manager_config.yaml - volumes: - - name: manager-config - configMap: - name: manager-config diff --git a/config/manager/controller_manager_config.yaml b/config/manager/controller_manager_config.yaml deleted file mode 100644 index b6f54a31..00000000 --- a/config/manager/controller_manager_config.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: controller-runtime.sigs.k8s.io/v1alpha1 -kind: ControllerManagerConfig -health: - healthProbeBindAddress: :8081 -metrics: - bindAddress: 127.0.0.1:8080 -webhook: - port: 9443 -leaderElection: - leaderElect: true - resourceName: d0f00250.cluster.x-k8s.io diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml index 60c6a8fe..f511d4ab 100644 --- a/config/manager/manager.yaml +++ b/config/manager/manager.yaml @@ -24,18 +24,22 @@ spec: - /manager args: - "--leader-elect" - - "--diagnostics-address=127.0.0.1:8080" - - "--insecure-diagnostics=true" + - "--v=${CAPC_LOGLEVEL:=0}" + - "--diagnostics-address=${CAPC_DIAGNOSTICS_ADDRESS:=:8443}" + - "--insecure-diagnostics=${CAPC_INSECURE_DIAGNOSTICS:=false}" + - "--cloudstackcluster-concurrency=${CAPC_CLOUDSTACKCLUSTER_CONCURRENCY:=10}" + - "--cloudstackmachine-concurrency=${CAPC_CLOUDSTACKMACHINE_CONCURRENCY:=10}" + - "--cloudstackaffinitygroup-concurrency=${CAPC_CLOUDSTACKAFFINITYGROUP_CONCURRENCY:=5}" + - "--cloudstackfailuredomain-concurrency=${CAPC_CLOUDSTACKFAILUREDOMAIN_CONCURRENCY:=5}" image: controller:latest name: manager - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - privileged: false - runAsUser: 65532 - runAsGroup: 65532 + ports: + - containerPort: 9440 + name: healthz + protocol: TCP + - containerPort: 8443 + name: metrics + protocol: TCP livenessProbe: httpGet: path: /healthz @@ -48,6 +52,14 @@ spec: port: 9440 initialDelaySeconds: 5 periodSeconds: 10 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsUser: 65532 + runAsGroup: 65532 resources: limits: cpu: 100m