[PR] feat(operator): secure operator metrics by default [camel-k]

["dshane1903 (via GitHub)" <gi...@apache.org>]

dshane1903 opened a new pull request, #6793:
URL: https://github.com/apache/camel-k/pull/6793

   ## Summary
   
   - serve the operator metrics endpoint over HTTPS by default, with an explicit HTTP compatibility opt-out
   - add optional Kubernetes bearer-token authentication and authorization, including the required TokenReview, SubjectAccessReview, and metrics-reader RBAC
   - update the example PodMonitor, generated Helm RBAC, documentation, and tests for the new configuration
   
   ## Configuration
   
   | Environment variable | Default | Purpose |
   | --- | --- | --- |
   | `KAMEL_OPERATOR_METRICS_SECURE` | `true` | Enable HTTPS metrics; set to `false` for the previous HTTP behavior |
   | `KAMEL_OPERATOR_METRICS_AUTH` | `false` | Enable Kubernetes authentication and authorization; requires HTTPS |
   | `KAMEL_OPERATOR_METRICS_CERT_DIR` | empty | Directory containing `tls.crt` and `tls.key`; controller-runtime generates a self-signed certificate when empty |
   
   The equivalent command-line flags are `--metrics-secure`, `--metrics-auth`, and `--metrics-cert-dir`.
   
   ## Compatibility and security
   
   HTTPS is the secure default while authentication remains independently opt-in because it requires scraper credentials and RBAC configuration. The provided PodMonitor now scrapes HTTPS and accepts controller-runtime's generated self-signed certificate. The documentation recommends mounting a trusted certificate and enabling verification for production.
   
   When authentication is enabled, the operator can create TokenReview and SubjectAccessReview requests. An unbound `camel-k-metrics-reader` ClusterRole is installed so administrators can explicitly grant `GET /metrics` to the scraper service account.
   
   ## Verification
   
   - `go test -vet=off -p=1 -count=1 ./pkg/cmd` (passed)
   - `go test -vet=off -p=1 -count=1 ./pkg/cmd/operator` (passed)
   - rendered `install/overlays/own-namespace`, `install/overlays/all-namespaces`, and `pkg/resources/config/prometheus` with Kustomize v5.7.1
   - `git diff --check` (passed)
   
   A final combined test rerun after formatting reached the linker but could not complete because the local disk was full (`errno=28`); the same focused packages passed immediately before formatting. CI should provide the clean-environment verification.
   
   Fixes #6779
   
   _AI-generated by Codex on behalf of Shane Duncan (@dshane1903)._


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(operator): secure operator metrics by default [camel-k]

["dshane1903 (via GitHub)" <gi...@apache.org>]

dshane1903 closed pull request #6793: feat(operator): secure operator metrics by default
URL: https://github.com/apache/camel-k/pull/6793


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org