Skip to content

[WIP] Replace kube-rbac-proxy sidecar with controller-runtime FilterProvider #502

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alebedev87 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[WIP] Replace kube-rbac-proxy sidecar with controller-runtime FilterProvider #502

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
57 changes: 17 additions & 40 deletions bundle/manifests/external-dns-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -379,6 +379,18 @@ spec:
spec:
clusterPermissions:
- rules:
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
- apiGroups:
- authorization.k8s.io
resources:
- subjectaccessreviews
verbs:
- create
- apiGroups:
- cloudcredential.openshift.io
resources:
Expand Down Expand Up @@ -435,18 +447,6 @@ spec:
- get
- list
- watch
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
- apiGroups:
- authorization.k8s.io
resources:
- subjectaccessreviews
verbs:
- create
serviceAccountName: external-dns-operator
deployments:
- name: external-dns-operator
Expand All @@ -466,7 +466,9 @@ spec:
spec:
containers:
- args:
- --metrics-bind-address=127.0.0.1:8080
- --metrics-bind-address=:8443
- --secure-metrics
- --metrics-tls-cert-dir=/var/run/secrets/serving-cert
- --operator-namespace=$(OPERATOR_NAMESPACE)
- --operand-namespace=$(OPERATOR_NAMESPACE)
- --externaldns-image=$(RELATED_IMAGE_EXTERNAL_DNS)
Expand All @@ -490,6 +492,8 @@ spec:
- containerPort: 9440
name: health-check
protocol: TCP
- containerPort: 8443
name: https
readinessProbe:
httpGet:
path: /readyz
Expand All @@ -510,33 +514,6 @@ spec:
seccompProfile:
type: RuntimeDefault
terminationMessagePolicy: FallbackToLogsOnError
- args:
- --secure-listen-address=0.0.0.0:8443
- --upstream=http://127.0.0.1:8080/
- --logtostderr=true
- --v=10
- --tls-cert-file=/var/run/secrets/serving-cert/tls.crt
- --tls-private-key-file=/var/run/secrets/serving-cert/tls.key
- --http2-disable
image: quay.io/openshift/origin-kube-rbac-proxy:latest
name: kube-rbac-proxy
ports:
- containerPort: 8443
name: https
resources:
requests:
cpu: 100m
memory: 20Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
terminationMessagePolicy: FallbackToLogsOnError
volumeMounts:
- mountPath: /var/run/secrets/serving-cert
name: metrics-cert
Expand Down
2 changes: 1 addition & 1 deletion config/default/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ resources:
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
#- ../certmanager

# Protect the /metrics endpoint by putting it behind auth.
# Enable secure metrics with authentication and authorization.
# If you want your controller-manager to expose the /metrics
# endpoint w/o any authn/z, please comment the following line.
patchesStrategicMerge:
Expand Down
33 changes: 10 additions & 23 deletions config/default/manager_auth_proxy_patch.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,37 +7,24 @@ spec:
template:
spec:
containers:
- name: kube-rbac-proxy
image: quay.io/openshift/origin-kube-rbac-proxy:latest
- name: external-dns-operator
args:
- "--secure-listen-address=0.0.0.0:8443"
- "--upstream=http://127.0.0.1:8080/"
- "--logtostderr=true"
- "--v=10"
- "--tls-cert-file=/var/run/secrets/serving-cert/tls.crt"
- "--tls-private-key-file=/var/run/secrets/serving-cert/tls.key"
- "--http2-disable"
terminationMessagePolicy: FallbackToLogsOnError
- --metrics-bind-address=:8443
- --secure-metrics
- --metrics-tls-cert-dir=/var/run/secrets/serving-cert
- --operator-namespace=$(OPERATOR_NAMESPACE)
- --operand-namespace=$(OPERATOR_NAMESPACE)
- --externaldns-image=$(RELATED_IMAGE_EXTERNAL_DNS)
- --trusted-ca-configmap=$(TRUSTED_CA_CONFIGMAP_NAME)
- --leader-elect
- --webhook-disable-http2
ports:
- containerPort: 8443
name: https
resources:
requests:
cpu: 100m
memory: 20Mi
volumeMounts:
- mountPath: /var/run/secrets/serving-cert
name: metrics-cert
readOnly: true
securityContext:
capabilities:
drop:
- "ALL"
privileged: false
runAsNonRoot: true
allowPrivilegeEscalation: false
seccompProfile:
type: "RuntimeDefault"
volumes:
- name: metrics-cert
secret:
Expand Down
24 changes: 12 additions & 12 deletions config/default/manager_insecure_tls_auth_proxy_patch.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# This patch inject a sidecar container which is a HTTP proxy for the
# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
# This patch configures metrics with secure serving but without
# external TLS certificates (controller-runtime will generate self-signed certs).
# Use for development/testing environments only.
Comment on lines +1 to +3

@coderabbitai coderabbitai Bot Jun 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Expect to see a non-empty DefaultMetricsTLSCertDir and operator wiring that assigns it to metrics CertDir.
rg -n -C3 'DefaultMetricsTLSCertDir|MetricsTLSCertDir|metrics-tls-cert-dir|SecureMetrics|CertDir' --glob '*.go' --glob '*.yaml' --glob '*.yml'

python - <<'PY'
from pathlib import Path

patch = Path("config/default/manager_insecure_tls_auth_proxy_patch.yaml").read_text()
print("insecure patch has metrics-tls-cert-dir arg:", "--metrics-tls-cert-dir" in patch)
print("insecure patch mounts serving-cert path:", "/var/run/secrets/serving-cert" in patch)
PY

Repository: openshift/external-dns-operator

Length of output: 32244

Override the TLS cert dir for the self-signed metrics patch.

This patch omits --metrics-tls-cert-dir, so the operator defaults to /var/run/secrets/serving-cert even though no cert volume is mounted. For self-signed metrics in development/testing, explicitly pass an empty cert dir to use the temporary directory.

Proposed fix 
         - --metrics-bind-address=:8443
         - --secure-metrics
+        - --metrics-tls-cert-dir=
         - --operator-namespace=$(OPERATOR_NAMESPACE)
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@config/default/manager_insecure_tls_auth_proxy_patch.yaml` around lines 1 -
3, The patch omits the `--metrics-tls-cert-dir` flag, causing the operator to
default to `/var/run/secrets/serving-cert` even though no cert volume is mounted
in this development/testing configuration. Add an explicit
`--metrics-tls-cert-dir` argument to the manager container args in the patch and
set it to an empty string or a temporary directory path so that self-signed
metrics certificates are generated in a writable location instead of the missing
mounted volume.

apiVersion: apps/v1
kind: Deployment
metadata:
Expand All @@ -9,17 +10,16 @@ spec:
template:
spec:
containers:
- name: kube-rbac-proxy
image: quay.io/openshift/origin-kube-rbac-proxy:latest
- name: external-dns-operator
args:
- "--secure-listen-address=0.0.0.0:8443"
- "--upstream=http://127.0.0.1:8080/"
- "--logtostderr=true"
- "--v=10"
- --metrics-bind-address=:8443
- --secure-metrics
- --operator-namespace=$(OPERATOR_NAMESPACE)
- --operand-namespace=$(OPERATOR_NAMESPACE)
- --externaldns-image=$(RELATED_IMAGE_EXTERNAL_DNS)
- --trusted-ca-configmap=$(TRUSTED_CA_CONFIGMAP_NAME)
- --leader-elect
- --webhook-disable-http2
ports:
- containerPort: 8443
name: https
resources:
requests:
cpu: 100m
memory: 20Mi
2 changes: 1 addition & 1 deletion config/manager/manager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ spec:
- name: external-dns-operator
image: quay.io/openshift/origin-external-dns-operator:latest
args:
- --metrics-bind-address=127.0.0.1:8080
- --metrics-bind-address=:8443
- --operator-namespace=$(OPERATOR_NAMESPACE)
- --operand-namespace=$(OPERATOR_NAMESPACE)
- --externaldns-image=$(RELATED_IMAGE_EXTERNAL_DNS)
Expand Down
17 changes: 0 additions & 17 deletions config/rbac/auth_proxy_role.yaml
View file
Open in desktop

This file was deleted.

12 changes: 0 additions & 12 deletions config/rbac/auth_proxy_role_binding.yaml
View file
Open in desktop

This file was deleted.

5 changes: 0 additions & 5 deletions config/rbac/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,7 @@ resources:
- role_binding.yaml
- leader_election_role.yaml
- leader_election_role_binding.yaml
# Comment the following 4 lines if you want to disable
# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
# which protects your /metrics endpoint.
- auth_proxy_service.yaml
- auth_proxy_role.yaml
- auth_proxy_role_binding.yaml
- auth_proxy_client_clusterrole.yaml
- operand_role.yaml
- operand_rolebinding.yaml
Expand Down
12 changes: 12 additions & 0 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,18 @@ kind: ClusterRole
metadata:
name: external-dns-operator
rules:
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
- apiGroups:
- authorization.k8s.io
resources:
- subjectaccessreviews
verbs:
- create
- apiGroups:
- cloudcredential.openshift.io
resources:
Expand Down
13 changes: 13 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ require (
)

require (
cel.dev/expr v0.19.1 // indirect
cloud.google.com/go/auth v0.13.0 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.6 // indirect
cloud.google.com/go/compute/metadata v0.6.0 // indirect
Expand All @@ -41,6 +42,7 @@ require (
github.com/Azure/go-autorest/autorest/to v0.3.0 // indirect
github.com/Azure/go-autorest/logger v0.2.1 // indirect
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
Expand All @@ -53,6 +55,7 @@ require (
github.com/aws/smithy-go v1.25.1 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver/v4 v4.0.0 // indirect
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
Expand All @@ -71,12 +74,14 @@ require (
github.com/gobuffalo/flect v1.0.3 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
github.com/google/cel-go v0.23.2 // indirect
github.com/google/gnostic-models v0.6.9 // indirect
github.com/google/s2a-go v0.1.8 // indirect
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
github.com/googleapis/gax-go/v2 v2.14.1 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
Expand All @@ -98,13 +103,18 @@ require (
github.com/spf13/afero v1.12.0 // indirect
github.com/spf13/cobra v1.9.1 // indirect
github.com/spf13/pflag v1.0.6 // indirect
github.com/stoewer/go-strcase v1.3.0 // indirect
github.com/x448/float16 v0.8.4 // indirect
github.com/xlab/treeprint v1.2.0 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
go.opentelemetry.io/otel v1.33.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 // indirect
go.opentelemetry.io/otel/metric v1.33.0 // indirect
go.opentelemetry.io/otel/sdk v1.33.0 // indirect

@coderabbitai coderabbitai Bot Jun 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

curl -sS https://api.osv.dev/v1/query \
  -H 'Content-Type: application/json' \
  -d '{
    "package": {"ecosystem":"Go","name":"go.opentelemetry.io/otel/sdk"},
    "version":"1.33.0"
  }' | jq '{id: .id, aliases: .aliases, summary: .summary, affected: .affected}'

Repository: openshift/external-dns-operator

Length of output: 150

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Query OSV for ALL vulnerabilities in this package (not pinned to version)
curl -sS https://api.osv.dev/v1/query \
  -H 'Content-Type: application/json' \
  -d '{
    "package": {"ecosystem":"Go","name":"go.opentelemetry.io/otel/sdk"}
  }' | jq '.vulns[] | {id, aliases, summary, affected: (.affected[0] | {versions, ranges})}'

Repository: openshift/external-dns-operator

Length of output: 1413

🌐 Web query:

GO-2026-4394 vulnerability go.opentelemetry.io/otel/sdk

💡 Result:

GO-2026-4394 is a security vulnerability in the go.opentelemetry.io/otel/sdk package, identified by CVE-2026-24051 and GHSA-9h8m-3fm2-qjrq [1][2]. Vulnerability Details: The vulnerability is an Untrusted Search Path issue (CWE-426) affecting the resource detection code within the SDK [3][4]. Specifically, the SDK would execute system commands using a bare name, which allowed the PATH environment variable to be manipulated to point to a malicious binary [3][4]. By placing a malicious executable earlier in the search path, an attacker with local access could achieve arbitrary code execution in the context of the application [3][4]. Affected Versions and Fixes: The vulnerability was introduced in version 1.21.0 and addressed in version 1.40.0, which updated the SDK to use absolute paths for the affected commands [1][5][4]. Note on Related Vulnerabilities: A follow-up vulnerability, CVE-2026-39883 (GHSA-hfvc-g4fc-pqhx), was identified because the fix for GO-2026-4394 only addressed the issue for macOS/Darwin systems while leaving other BSD and Solaris platforms vulnerable [6][7]. That subsequent issue was fixed in version 1.43.0 [6]. Users are advised to upgrade to the latest available version of the SDK to ensure both issues are mitigated [6][8].

Citations:

Upgrade go.opentelemetry.io/otel/sdk to v1.43.0 or later before merge.

Line 115 pins go.opentelemetry.io/otel/sdk v1.33.0, which is vulnerable to GO-2026-4394 (CVE-2026-24051 / GHSA-9h8m-3fm2-qjrq). This PATH hijacking vulnerability enables arbitrary code execution in versions 1.21.0 through 1.39.0. While v1.40.0 fixes this issue, a follow-up vulnerability (CVE-2026-39883) was discovered in the same code path, fixed only in v1.43.0. Upgrade to v1.43.0 and refresh dependent OTLP modules to keep versions coherent.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 115-115: go.opentelemetry.io/otel/sdk 1.33.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk

(GO-2026-4394)

[HIGH] 115-115: go.opentelemetry.io/otel/sdk 1.33.0: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

(GHSA-9h8m-3fm2-qjrq)

[HIGH] 115-115: go.opentelemetry.io/otel/sdk 1.33.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

(GHSA-hfvc-g4fc-pqhx)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 115, The go.opentelemetry.io/otel/sdk dependency is pinned to
v1.33.0 which contains security vulnerabilities that are only fixed in v1.43.0
or later. Update the go.opentelemetry.io/otel/sdk version from v1.33.0 to
v1.43.0 in the go.mod file. After updating, also refresh any dependent OTLP
modules that reference go.opentelemetry.io/otel/sdk to maintain version
coherence across all module dependencies.

Sources: Coding guidelines, Linters/SAST tools

go.opentelemetry.io/otel/trace v1.33.0 // indirect
go.opentelemetry.io/proto/otlp v1.4.0 // indirect
go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
Expand All @@ -120,6 +130,7 @@ require (
golang.org/x/time v0.9.0 // indirect
golang.org/x/tools v0.32.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20241223144023-3abc09e42ca8 // indirect
google.golang.org/grpc v1.68.1 // indirect
google.golang.org/protobuf v1.36.5 // indirect
Expand All @@ -130,9 +141,11 @@ require (
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/apiextensions-apiserver v0.33.0 // indirect
k8s.io/code-generator v0.33.0 // indirect
k8s.io/component-base v0.33.4 // indirect
k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
sigs.k8s.io/kustomize/api v0.17.3 // indirect
sigs.k8s.io/kustomize/cmd/config v0.14.2 // indirect
Expand Down
Loading