-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Is kube-rbac-proxy required? #4325
Copy link
Copy link
Closed
Labels
area/dependencyIssues or PRs related to dependency changesIssues or PRs related to dependency changeskind/documentationCategorizes issue or PR as related to documentation.Categorizes issue or PR as related to documentation.kind/featureCategorizes issue or PR as related to a new feature.Categorizes issue or PR as related to a new feature.
Description
Metadata
Metadata
Assignees
Labels
area/dependencyIssues or PRs related to dependency changesIssues or PRs related to dependency changeskind/documentationCategorizes issue or PR as related to documentation.Categorizes issue or PR as related to documentation.kind/featureCategorizes issue or PR as related to a new feature.Categorizes issue or PR as related to a new feature.
User Story
As a [distributor of Cluster-API] I would like to [distribute container images for CAPI] for [reasons].
Detailed Description
kube-rbac-proxy seems like a great project, and this is not meant to imply any mistrust of @brancz or his work, but distributing a security proxy that is a developer's personal project is concerning from both a a supply-chain and governance point of view.
Can someone clarify if kube-rbac-proxy is a required sidecar for CAPI controllers? If it is not, can templates and documentation be updated to reflect that and provide installation instructions that don't require it?
Anything else you would like to add:
My initial read is that kube-rbac-proxy is just being used to guard
/metricsendpoints for Prometheus, but is there more to it then that?/kind feature
/kind documentation