refactor: remove kube-rbac-proxy and update metrics service configuration

.github/workflows/ci.yaml

@@ -33,11 +33,11 @@ jobs:
           profile: minimal
           components: rustfmt, clippy
 
-      - uses: manusa/actions-setup-minikube@v2.13.0
+      - uses: manusa/actions-setup-minikube@v2.16.1
         with:
-           minikube version: 'v1.34.0'
+           minikube version: 'v1.38.1'
            driver: docker
-           kubernetes version: 'v1.31.0'
+           kubernetes version: 'v1.35.2'
            github token: ${{ secrets.GITHUB_TOKEN }}
            start args: "--addons registry --cpus=$MINIKUBE_CPUS --memory=$MINKUBE_MEM"
 

Dockerfile

@@ -1,4 +1,4 @@
-FROM rust:1.82 AS builder
+FROM rust:1.88 AS builder
 
 ENV CARGO_HOME=/usr/local/cargo
 ENV RUSTUP_HOME=/usr/local/rustup

chirpstack-operator/src/assets/service_monitor.yaml

@@ -14,11 +14,8 @@ metadata:
 spec:
   endpoints:
     - path: /metrics
-      port: https
-      scheme: https
-      bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
-      tlsConfig:
-        insecureSkipVerify: true
+      port: metrics
+      scheme: http
   selector:
     matchLabels:
       control-plane: controller-manager

chirpstack-operator/src/bin/controller.rs

@@ -291,7 +291,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         .expect("Failed to install rustls crypto provider");
 
     PrometheusBuilder::new()
-        .with_http_listener(([127, 0, 0, 1], 8383))
+        .with_http_listener(([0, 0, 0, 0], 8383))
         .set_buckets(&[0.1, 0.5, 1.0, 3.0])?
         .install()?;
 

config/manager/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 
 resources:
 - ./manager.yaml
-- ./auth-proxy-service.yaml
+- ./metrics-service.yaml
 images:
 - name: chirpstack-operator
   newName: ghcr.io/deepshore/chirpstack-operator

config/manager/manager.yaml

@@ -49,28 +49,9 @@ spec:
                   fieldPath: metadata.namespace
             - name: RUST_LOG
               value: info
-        - name: kube-rbac-proxy
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - "ALL"
-          image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1
-          args:
-            - "--secure-listen-address=0.0.0.0:8443"
-            - "--upstream=http://127.0.0.1:8383/"
-            - "--logtostderr=true"
-            - "--v=0"
           ports:
-            - containerPort: 8443
+            - containerPort: 8383
               protocol: TCP
-              name: https
-          resources:
-            limits:
-              cpu: 500m
-              memory: 128Mi
-            requests:
-              cpu: 5m
-              memory: 64Mi
+              name: metrics
       serviceAccountName: controller-manager
       terminationGracePeriodSeconds: 10

config/manager/auth-proxy-service.yaml → config/manager/metrics-service.yaml

@@ -5,17 +5,17 @@ metadata:
     control-plane: controller-manager
     app.kubernetes.io/name: service
     app.kubernetes.io/instance: controller-manager-metrics-service
-    app.kubernetes.io/component: kube-rbac-proxy
+    app.kubernetes.io/component: manager
     app.kubernetes.io/created-by: chirpstack-operator
     app.kubernetes.io/part-of: chirpstack-operator
     app.kubernetes.io/managed-by: kustomize
   name: controller-manager-metrics-service
   namespace: system
 spec:
   ports:
-  - name: https
-    port: 8443
+  - name: metrics
+    port: 8383
     protocol: TCP
-    targetPort: https
+    targetPort: metrics
   selector:
     control-plane: controller-manager

config/rbac/kustomization.yaml

@@ -5,6 +5,3 @@ resources:
   - service_account.yaml
   - role.yaml
   - role_binding.yaml
-  - auth_proxy_client_clusterrole.yaml
-  - auth_proxy_role_binding.yaml
-  - auth_proxy_role.yaml