feat: remove kube-rbac-proxy

[emirot]

What

Following kubernetes-sigs/kubebuilder#3907
Also requested from helm chart argoproj-labs/gitops-promoter-helm#35

Test

For http

1. Install the gitops-promoter & argocd (go run cmd/main.go)
2. Install prometheus

helm repo add prometheus-community https://prometheus-community.github.io/helm-charts && helm repo update
helm install prometheus prometheus-community/kube-prometheus-stack \
   --namespace monitoring \
   --set grafana.enabled=true \
   --set grafana.adminPassword=admin \
   --set prometheus.prometheusSpec.serviceMonitorSelectorNilUsesHelmValues=false \
   --set prometheus.prometheusSpec.podMonitorSelectorNilUsesHelmValues=false

3. Add the service monitor

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: gitops-promoter
  namespace: monitoring
spec:
  namespaceSelector:
    matchNames:
      - promoter-system
  selector:
    matchLabels:
      control-plane: controller-manager
  endpoints:
    - port: http
      interval: 30s
      scheme: http

4. Port Foward

 kubectl port-forward svc/prometheus-kube-prometheus-prometheus 9090:9090 -n monitoring

5.Check If it is found

For https

1. Install the gitops-promoter & argocd (go run cmd/main.go)
2. Install prometheus

helm repo add prometheus-community https://prometheus-community.github.io/helm-charts && helm repo update
helm install prometheus prometheus-community/kube-prometheus-stack \
   --namespace monitoring \
   --set grafana.enabled=true \
   --set grafana.adminPassword=admin \
   --set prometheus.prometheusSpec.serviceMonitorSelectorNilUsesHelmValues=false \
   --set prometheus.prometheusSpec.podMonitorSelectorNilUsesHelmValues=false

3. Add the service monitor

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: gitops-promoter
  namespace: monitoring
spec:
  namespaceSelector:
    matchNames:
      - promoter-system
  selector:
    matchLabels:
      control-plane: controller-manager
  endpoints:
    - port: https
      interval: 30s
      scheme: https
      tlsConfig:
        insecureSkipVerify: true
      bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token

Change the configuration

# This patch configures the controller manager with proper bind addresses
apiVersion: apps/v1
kind: Deployment
metadata:
  name: controller-manager
  namespace: system
spec:
  template:
    spec:
      containers:
      - name: manager
        image: quay.io/argoprojlabs/gitops-promoter:latest
        args:
          - "--health-probe-bind-address=:8081"
          - "--metrics-bind-address=:8443"
          - "--metrics-secure=true"
          - "--leader-elect"

It also requieres a service account/ cluster role etc

apiVersion: v1
kind: ServiceAccount
metadata:
  name: prometheus-metrics
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: prometheus-metrics-reader-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: promoter-metrics-reader
subjects:
- kind: ServiceAccount
  name: prometheus-metrics
  namespace: monitoring
---
apiVersion: v1
kind: Secret
metadata:
  name: prometheus-metrics-token
  namespace: monitoring
  annotations:
    kubernetes.io/service-account.name: prometheus-metrics
type: kubernetes.io/service-account-token

[codecov-commenter]

Bundle Report

Bundle size has no change ✅

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.87%. Comparing base (1b9c5a3) to head (64339d2).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1095      +/-   ##
==========================================
+ Coverage   53.46%   53.87%   +0.40%     
==========================================
  Files          54       54              
  Lines        6168     6168              
==========================================
+ Hits         3298     3323      +25     
+ Misses       2511     2497      -14     
+ Partials      359      348      -11     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Copilot]

Pull request overview

This PR removes the kube-rbac-proxy sidecar container and implements metrics authentication directly using controller-runtime's built-in filters, following the Kubebuilder community recommendation from kubernetes-sigs/kubebuilder#3907. This simplifies the deployment architecture by eliminating an external dependency while maintaining secure access to the metrics endpoint.

Changes:

• Removed kube-rbac-proxy sidecar container and replaced it with controller-runtime's native authentication/authorization filters
• Updated RBAC configuration to grant the controller service account permissions for token and subject access reviews
• Modified the metrics endpoint to bind directly on port 8443 with TLS enabled

Reviewed changes

Copilot reviewed 15 out of 17 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
go.mod, go.sum	Added indirect dependencies for controller-runtime metrics authentication (OpenTelemetry, k8s.io/apiserver, etc.)
cmd/main.go	Configured metrics server with filters.WithAuthenticationAndAuthorization for built-in auth
config/rbac/metrics_auth_role.yaml	New role granting permissions to create tokenreviews and subjectaccessreviews for metrics auth
config/rbac/metrics_auth_role_binding.yaml	Binds the metrics auth role to the controller-manager service account
config/rbac/metrics_reader_role.yaml	New role for reading metrics endpoint
config/rbac/kustomization.yaml	Updated to reference new RBAC files instead of auth_proxy files
config/rbac/auth_proxy_*.yaml	Removed old kube-rbac-proxy RBAC configuration files
config/manager/deployment.yaml	Added port definitions for https (8443) and health (8081)
config/manager/metrics_service.yaml	Updated service labels and structure, removed old kube-rbac-proxy references
config/manager/kustomization.yaml	Added metrics_service.yaml to resources list
config/default/manager_auth_proxy_patch.yaml	Removed kube-rbac-proxy sidecar container, updated args to bind metrics on :8443 with --metrics-secure=true
config/release/kustomization.yaml	Added newName and newTag fields (should be removed - see comments)
dist/install.yaml	Generated file reflecting all configuration changes
Tiltfile	Removed references to old kube-rbac-proxy ClusterRoles and ClusterRoleBindings