Remove kube-rbac-proxy from cluster-api

Author: micahhausler

bootstrap/kubeadm/config/default/kustomization.yaml

@@ -20,10 +20,6 @@ patchesStrategicMerge:
   # Provide customizable hook for make targets.
   - manager_image_patch.yaml
   - manager_pull_policy.yaml
-  # Protect the /metrics endpoint by putting it behind auth.
-  # Only one of manager_auth_proxy_patch.yaml and
-  # manager_prometheus_metrics_patch.yaml should be enabled.
-  - manager_auth_proxy_patch.yaml
   # Enable webhook.
   - manager_webhook_patch.yaml
   # Inject certificate in the webhook definition.

bootstrap/kubeadm/config/default/manager_auth_proxy_patch.yaml

@@ -20,14 +20,17 @@ spec:
         - /manager
         args:
         - "--leader-elect"
-        - "--metrics-bind-addr=127.0.0.1:8080"
+        - "--metrics-bind-addr=:8080"
         - "--feature-gates=MachinePool=${EXP_MACHINE_POOL:=false}"
         image: controller:latest
         name: manager
         ports:
         - containerPort: 9440
           name: healthz
           protocol: TCP
+        - containerPort: 8080
+          name: metrics
+          protocol: TCP
         readinessProbe:
           httpGet:
             path: /readyz

bootstrap/kubeadm/config/manager/manager.yaml

@@ -4,6 +4,3 @@ resources:
 - service_account.yaml
 - leader_election_role.yaml
 - leader_election_role_binding.yaml
-- auth_proxy_service.yaml
-- auth_proxy_role.yaml
-- auth_proxy_role_binding.yaml

bootstrap/kubeadm/config/rbac/auth_proxy_role.yaml

@@ -80,7 +80,6 @@ func Test_clusterctlClient_InitImages(t *testing.T) {
 				kubeconfigContext:      "mgmt-context",
 			},
 			expectedImages: []string{
-				"gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0",
 				"k8s.gcr.io/cluster-api-aws/cluster-api-aws-controller:v0.5.3",
 			},
 			wantErr: false,
@@ -828,8 +827,6 @@ spec:
   template:
     spec:
       containers:
-      - image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
-        name: kube-rbac-proxy
       - image: k8s.gcr.io/cluster-api-aws/cluster-api-aws-controller:v0.5.3
         name: manager
         volumeMounts:

bootstrap/kubeadm/config/rbac/auth_proxy_role_binding.yaml

@@ -78,10 +78,6 @@ func Test_inspectImages(t *testing.T) {
 												"name":  controllerContainerName,
 												"image": "gcr.io/k8s-staging-cluster-api/cluster-api-controller:master",
 											},
-											{
-												"name":  "kube-rbac-proxy",
-												"image": "gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0",
-											},
 										},
 									},
 								},
@@ -90,7 +86,7 @@ func Test_inspectImages(t *testing.T) {
 					},
 				},
 			},
-			want:    []string{"gcr.io/k8s-staging-cluster-api/cluster-api-controller:master", "gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0"},
+			want:    []string{"gcr.io/k8s-staging-cluster-api/cluster-api-controller:master"},
 			wantErr: false,
 		},
 		{

bootstrap/kubeadm/config/rbac/auth_proxy_service.yaml

@@ -19,10 +19,6 @@ patchesStrategicMerge:
 # Provide customizable hook for make targets.
 - manager_image_patch.yaml
 - manager_pull_policy.yaml
-# Protect the /metrics endpoint by putting it behind auth.
-# Only one of manager_auth_proxy_patch.yaml and
-# manager_prometheus_metrics_patch.yaml should be enabled.
-- manager_auth_proxy_patch.yaml
 # Enable webhook.
 - manager_webhook_patch.yaml
 # Inject certificate in the webhook definition.