krp: Generate secret for service serving certs (#769)

Author: philipgough

magefiles/operator.go

@@ -706,13 +706,14 @@ func operatorResources(namespace string, m TemplateMaps) []runtime.Object {
 				Name:      "thanos-operator-controller-manager-metrics-service",
 				Namespace: namespace,
 				Labels: map[string]string{
-					"app.kubernetes.io/component":  "kube-rbac-proxy",
-					"app.kubernetes.io/created-by": "thanos-operator",
-					"app.kubernetes.io/instance":   "controller-manager-metrics-service",
-					"app.kubernetes.io/managed-by": "rhobs",
-					"app.kubernetes.io/name":       "service",
-					"app.kubernetes.io/part-of":    "thanos-operator",
-					"control-plane":                "controller-manager",
+					"app.kubernetes.io/component":                        "kube-rbac-proxy",
+					"app.kubernetes.io/created-by":                       "thanos-operator",
+					"app.kubernetes.io/instance":                         "controller-manager-metrics-service",
+					"app.kubernetes.io/managed-by":                       "rhobs",
+					"app.kubernetes.io/name":                             "service",
+					"app.kubernetes.io/part-of":                          "thanos-operator",
+					"control-plane":                                      "controller-manager",
+					"service.beta.openshift.io/serving-cert-secret-name": "kube-rbac-proxy-tls",
 				},
 			},
 			Spec: corev1.ServiceSpec{
@@ -854,8 +855,9 @@ func operatorDeployment(namespace string, m TemplateMaps) *appsv1.Deployment {
 							Args: []string{
 								"--secure-listen-address=0.0.0.0:8443",
 								"--upstream=http://127.0.0.1:8080/",
-								"--logtostderr=true",
-								"--v=0",
+								"--v=4",
+								"--tls-cert-file=/etc/tls/private/tls.crt",
+								"--tls-private-key-file=/etc/tls/private/tls.key",
 							},
 							Ports: []corev1.ContainerPort{
 								{
@@ -919,6 +921,24 @@ func operatorDeployment(namespace string, m TemplateMaps) *appsv1.Deployment {
 									Drop: []corev1.Capability{"ALL"},
 								},
 							},
+							VolumeMounts: []corev1.VolumeMount{
+								{
+									Name:      "kube-rbac-proxy-tls",
+									MountPath: "/etc/tls/private",
+									ReadOnly:  true,
+								},
+							},
+						},
+					},
+					Volumes: []corev1.Volume{
+						{
+							Name: "kube-rbac-proxy-tls",
+							VolumeSource: corev1.VolumeSource{
+								Secret: &corev1.SecretVolumeSource{
+									SecretName: "kube-rbac-proxy-tls",
+									Optional:   ptr.To(false),
+								},
+							},
 						},
 					},
 					ServiceAccountName:            "thanos-operator-controller-manager",

resources/services/bundle/staging/operator.yaml

@@ -16,6 +16,7 @@ objects:
       app.kubernetes.io/name: service
       app.kubernetes.io/part-of: thanos-operator
       control-plane: controller-manager
+      service.beta.openshift.io/serving-cert-secret-name: kube-rbac-proxy-tls
     name: thanos-operator-controller-manager-metrics-service
     namespace: rhobs-stage
   spec:
@@ -65,8 +66,9 @@ objects:
         - args:
           - --secure-listen-address=0.0.0.0:8443
           - --upstream=http://127.0.0.1:8080/
-          - --logtostderr=true
-          - --v=0
+          - --v=4
+          - --tls-cert-file=/etc/tls/private/tls.crt
+          - --tls-private-key-file=/etc/tls/private/tls.key
           image: registry.redhat.io/openshift4/ose-kube-rbac-proxy@sha256:98455d503b797b6b02edcfd37045c8fab0796b95ee5cf4cfe73b221a07e805f0
           imagePullPolicy: IfNotPresent
           name: kube-rbac-proxy
@@ -129,10 +131,19 @@ objects:
             capabilities:
               drop:
               - ALL
+          volumeMounts:
+          - mountPath: /etc/tls/private
+            name: kube-rbac-proxy-tls
+            readOnly: true
         securityContext:
           runAsNonRoot: true
         serviceAccountName: thanos-operator-controller-manager
         terminationGracePeriodSeconds: 10
+        volumes:
+        - name: kube-rbac-proxy-tls
+          secret:
+            optional: false
+            secretName: kube-rbac-proxy-tls
   status: {}
 - apiVersion: v1
   kind: ServiceAccount