Should CAPI pod in 0.2.8 have a kube_rbac_proxy sidecar like CABPK?

[corrieb]

This isn't really a bug, but means of tracking a question that was asked in Slack.

CAPBK 0.1.5 has the kube_auth_proxy sidecar and our infrastructure provider pod also uses the kube_auth_proxy. I believe it's to protect the metrics endpoint.

CAPI 0.2.8 doesn't have this sidecar configured. Curious as to whether that's an oversight or deliberate.

Thanks.

/kind feature

[ncdc]

It's possible the sidecar came from a newer version of kubebuilder generation. We'll investigate & make sure this is consistent.

[noamran]

/assign

[noamran]

Summarizing a discussion with @ncdc -
In v1alpha2, the sidecar is enabled in CABPK while it’s not present in CAPI.
This probably stems from the fact that an older version of kubebuilder was used for CAPI.

In v1alpha3, the sidecar is enabled in CABPK and the KCP but not for CAPI.

Based on the Is the metrics endpoint protected ? part of the Monitoring section in the kubebuilder book - we should have it enabled for all our managers.
Will work on enabling the sidecar in the master core capi manager.

[chuckha]

Thanks for the update! I wondered where that came from (sidenote: I removed a period in the kubebuilder book link if you're wondering why i edited your comment)

[joonas]

This was fixed in #2035 against master.

@corrieb do you need this backported for v1alpha2?

/close

[k8s-ci-robot]

@joonas: Closing this issue.

In response to this:

This was fixed in #2035 against master.

@corrieb do you need this backported for v1alpha2?

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.