Repository: kubernetes-sigs/security-profiles-operator
Pull request #455 (2021-05-19 07:30:59)

Update kind to v0.11.0
#### What type of PR is this?


/kind cleanup

#### What this PR does / why we need it:
Bump kind to the latest release.
#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/455#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov-commenter: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/455?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) Report
> Merging [#455](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/455?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (1e391fe) into [master](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/6007dd44e6184859f90d7a6f140f1ecf3874493b?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (6007dd4) will **not change** coverage.
> The diff coverage is `n/a`.


```diff
@@           Coverage Diff           @@
##           master     #455   +/-   ##
=======================================
  Coverage   37.17%   37.17%           
=======================================
  Files          23       23           
  Lines        1049     1049           
=======================================
  Hits          390      390           
  Misses        644      644           
  Partials       15       15           
```

JAORMX: /lgtm

Patch:
diff --git a/dependencies.yaml b/dependencies.yaml
index e612a32f7..f8668d014 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -26,13 +26,13 @@ dependencies:
       match: .*https://github.com/jetstack/cert-manager/releases/download/v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?/cert-manager.yaml
 
   - name: kind
-    version: 0.10.0
+    version: 0.11.0
     refPaths:
     - path: test/suite_test.go
       match: \s+kindVersion\s+= "v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?"
 
   - name: kind-image
-    version: 1.20.2
+    version: 1.21.1
     refPaths:
     - path: test/suite_test.go
       match: \s+kindImage\s+= "kindest/node:v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?"
diff --git a/deploy/base/certificate.yaml b/deploy/base/certificate.yaml
index a2a808105..eb97613f4 100644
--- a/deploy/base/certificate.yaml
+++ b/deploy/base/certificate.yaml
@@ -20,3 +20,21 @@ spec:
     kind: Issuer
     name: selfsigned-issuer
   secretName: webhook-server-cert
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: metrics-cert
+  namespace: security-profiles-operator
+spec:
+  subject:
+    organizations:
+    - security-profiles-operator
+  dnsNames:
+  - metrics.security-profiles-operator
+  - metrics.security-profiles-operator.svc
+  - metrics.security-profiles-operator.svc.cluster.local
+  issuerRef:
+    kind: Issuer
+    name: selfsigned-issuer
+  secretName: metrics-server-cert
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index 07c358af7..27f5e0921 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -1533,6 +1533,26 @@ spec:
     name: selfsigned-issuer
   secretName: webhook-server-cert
 ---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  labels:
+    app: security-profiles-operator
+  name: metrics-cert
+  namespace: security-profiles-operator
+spec:
+  dnsNames:
+  - metrics.security-profiles-operator
+  - metrics.security-profiles-operator.svc
+  - metrics.security-profiles-operator.svc.cluster.local
+  issuerRef:
+    kind: Issuer
+    name: selfsigned-issuer
+  secretName: metrics-server-cert
+  subject:
+    organizations:
+    - security-profiles-operator
+---
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index d5f50fbc9..18906a7b0 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -1531,6 +1531,26 @@ spec:
     name: selfsigned-issuer
   secretName: webhook-server-cert
 ---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  labels:
+    app: security-profiles-operator
+  name: metrics-cert
+  namespace: security-profiles-operator
+spec:
+  dnsNames:
+  - metrics.security-profiles-operator
+  - metrics.security-profiles-operator.svc
+  - metrics.security-profiles-operator.svc.cluster.local
+  issuerRef:
+    kind: Issuer
+    name: selfsigned-issuer
+  secretName: metrics-server-cert
+  subject:
+    organizations:
+    - security-profiles-operator
+---
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/installation-usage.md b/installation-usage.md
index 7d4f3927a..e565bafc9 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -428,6 +428,40 @@ NAME                 ROLE                             AGE   USERS   GROUPS   SER
 spo-metrics-client   ClusterRole/spo-metrics-client   35m                    security-profiles-operator/default
 ```
 
+Every metrics server pod from the DaemonSet runs with the same set of certificates
+(secret `metrics-server-cert`: `tls.crt` and `tls.key`) in the
+`security-profiles-operator` namespace. This means a pod like this can be used
+to omit the `--insecure/-k` flag:
+
+```yaml
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod
+spec:
+  containers:
+    - name: test-container
+      image: registry.fedoraproject.org/fedora-minimal:latest
+      command:
+        - bash
+        - -c
+        - |
+          curl -s --cacert /var/run/secrets/metrics/ca.crt \
+            -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
+            https://metrics.security-profiles-operator/metrics-spod
+      volumeMounts:
+        - mountPath: /var/run/secrets/metrics
+          name: metrics-cert-volume
+          readOnly: true
+  restartPolicy: Never
+  volumes:
+    - name: metrics-cert-volume
+      secret:
+        defaultMode: 420
+        secretName: metrics-server-cert
+```
+
 ### Available metrics
 
 The controller-runtime (`/metrics`) as well as the DaemonSet endpoint
diff --git a/internal/pkg/manager/spod/bindata/spod.go b/internal/pkg/manager/spod/bindata/spod.go
index 6672e6716..10408a9f9 100644
--- a/internal/pkg/manager/spod/bindata/spod.go
+++ b/internal/pkg/manager/spod/bindata/spod.go
@@ -18,6 +18,7 @@ package bindata
 
 import (
 	"fmt"
+	"path/filepath"
 
 	appsv1 "k8s.io/api/apps/v1"
 	v1 "k8s.io/api/core/v1"
@@ -38,6 +39,7 @@ var (
 	hostPathDirectoryOrCreate       = v1.HostPathDirectoryOrCreate
 	metricsPort               int32 = 9443
 	healthzPath                     = "/healthz"
+	metricsCertPath                 = "/var/run/secrets/metrics"
 )
 
 const (
@@ -90,6 +92,10 @@ var Manifest = &appsv1.DaemonSet{
 								MountPath: "/opt/spo-profiles",
 								ReadOnly:  true,
 							},
+							{
+								Name:      "metrics-cert-volume",
+								MountPath: metricsCertPath,
+							},
 						},
 						SecurityContext: &v1.SecurityContext{
 							AllowPrivilegeEscalation: &falsely,
@@ -399,6 +405,8 @@ semodule -i /opt/spo-profiles/selinuxd.cil
 							fmt.Sprintf("--secure-listen-address=0.0.0.0:%d", metricsPort),
 							"--upstream=http://127.0.0.1:8080",
 							"--v=10",
+							fmt.Sprintf("--tls-cert-file=%s", filepath.Join(metricsCertPath, "tls.crt")),
+							fmt.Sprintf("--tls-private-key-file=%s", filepath.Join(metricsCertPath, "tls.key")),
 						},
 						Resources: v1.ResourceRequirements{
 							Requests: v1.ResourceList{
@@ -418,6 +426,13 @@ semodule -i /opt/spo-profiles/selinuxd.cil
 						Ports: []v1.ContainerPort{
 							{Name: "https", ContainerPort: metricsPort},
 						},
+						VolumeMounts: []v1.VolumeMount{
+							{
+								Name:      "metrics-cert-volume",
+								MountPath: metricsCertPath,
+								ReadOnly:  true,
+							},
+						},
 					},
 				},
 				Volumes: []v1.Volume{
@@ -514,6 +529,14 @@ semodule -i /opt/spo-profiles/selinuxd.cil
 							},
 						},
 					},
+					{
+						Name: "metrics-cert-volume",
+						VolumeSource: v1.VolumeSource{
+							Secret: &v1.SecretVolumeSource{
+								SecretName: "metrics-server-cert",
+							},
+						},
+					},
 				},
 				Tolerations: []v1.Toleration{
 					{


Test patch:
diff --git a/test/suite_test.go b/test/suite_test.go
index 3ea6602a1..a41f97a84 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -37,10 +37,10 @@ import (
 )
 
 const (
-	kindVersion      = "v0.10.0"
-	kindImage        = "kindest/node:v1.20.2"
-	kindDarwinSHA512 = "f2da2d9695ef6d26ff7183f764506223b605bc4638f04742184622ab41599988d0489a54d92ccbad90a5420e47e0868350654d3f8851e0c9afb0fe3539557e00" // nolint: lll
-	kindLinuxSHA512  = "1d2ef9f377ed513850dfd5028c80f3fefd7e3f28e3fc6050593c8a3894b74a40b9761f401ccf44d5aa199e9c753bbb9c1ffb51319f4864a1a2ba184d1574d242" // nolint: lll
+	kindVersion      = "v0.11.0"
+	kindImage        = "kindest/node:v1.21.1"
+	kindDarwinSHA512 = "94395245b680511491d7baae35e73ce6915c5c046e9b5f7f8cbcaa666fd5318798a321dffcaf7a41068fc2d1d61ab34f2b55db833fb2738e8aa984e1d5b08bac" // nolint: lll
+	kindLinuxSHA512  = "aa5438246a8917d0bfd910d7dd1456dfba5fe7106f89c1a8327939b7f199dbfb42c833727306203bd91d3803781d76d967e2a7e07efaeb2be3cbc2d15febc30f" // nolint: lll
 )
 
 var (