dshane1903 opened a new pull request, #6793: URL: https://github.com/apache/camel-k/pull/6793
## Summary - serve the operator metrics endpoint over HTTPS by default, with an explicit HTTP compatibility opt-out - add optional Kubernetes bearer-token authentication and authorization, including the required TokenReview, SubjectAccessReview, and metrics-reader RBAC - update the example PodMonitor, generated Helm RBAC, documentation, and tests for the new configuration ## Configuration | Environment variable | Default | Purpose | | --- | --- | --- | | `KAMEL_OPERATOR_METRICS_SECURE` | `true` | Enable HTTPS metrics; set to `false` for the previous HTTP behavior | | `KAMEL_OPERATOR_METRICS_AUTH` | `false` | Enable Kubernetes authentication and authorization; requires HTTPS | | `KAMEL_OPERATOR_METRICS_CERT_DIR` | empty | Directory containing `tls.crt` and `tls.key`; controller-runtime generates a self-signed certificate when empty | The equivalent command-line flags are `--metrics-secure`, `--metrics-auth`, and `--metrics-cert-dir`. ## Compatibility and security HTTPS is the secure default while authentication remains independently opt-in because it requires scraper credentials and RBAC configuration. The provided PodMonitor now scrapes HTTPS and accepts controller-runtime's generated self-signed certificate. The documentation recommends mounting a trusted certificate and enabling verification for production. When authentication is enabled, the operator can create TokenReview and SubjectAccessReview requests. An unbound `camel-k-metrics-reader` ClusterRole is installed so administrators can explicitly grant `GET /metrics` to the scraper service account. ## Verification - `go test -vet=off -p=1 -count=1 ./pkg/cmd` (passed) - `go test -vet=off -p=1 -count=1 ./pkg/cmd/operator` (passed) - rendered `install/overlays/own-namespace`, `install/overlays/all-namespaces`, and `pkg/resources/config/prometheus` with Kustomize v5.7.1 - `git diff --check` (passed) A final combined test rerun after formatting reached the linker but could not complete because the local disk was full (`errno=28`); the same focused packages passed immediately before formatting. CI should provide the clean-environment verification. Fixes #6779 _AI-generated by Codex on behalf of Shane Duncan (@dshane1903)._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
