generate client key and certificates

assets/alertmanager/service-monitor.yaml

@@ -16,6 +16,8 @@ spec:
     scheme: https
     tlsConfig:
       caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
+      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
       serverName: alertmanager-main
   selector:
     matchLabels:

assets/cluster-monitoring-operator/metrics-client-ca.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+data: {}
+kind: ConfigMap
+metadata:
+  name: metrics-client-ca
+  namespace: openshift-monitoring

assets/cluster-monitoring-operator/metrics-client-certs.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+data: {}
+kind: Secret
+metadata:
+  name: metrics-client-certs
+  namespace: openshift-monitoring
+type: Opaque

assets/control-plane/service-monitor-kubelet.yaml

@@ -53,7 +53,9 @@ spec:
     scrapeTimeout: 30s
     tlsConfig:
       caFile: /etc/prometheus/configmaps/kubelet-serving-ca-bundle/ca-bundle.crt
+      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
       insecureSkipVerify: false
+      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
   - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
     honorLabels: true
     honorTimestamps: false
@@ -77,7 +79,9 @@ spec:
     scrapeTimeout: 30s
     tlsConfig:
       caFile: /etc/prometheus/configmaps/kubelet-serving-ca-bundle/ca-bundle.crt
+      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
       insecureSkipVerify: false
+      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
   - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
     honorLabels: true
     interval: 30s
@@ -91,7 +95,9 @@ spec:
     scrapeTimeout: 30s
     tlsConfig:
       caFile: /etc/prometheus/configmaps/kubelet-serving-ca-bundle/ca-bundle.crt
+      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
       insecureSkipVerify: false
+      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
   - interval: 30s
     metricRelabelings:
     - action: drop

assets/grafana/service-monitor.yaml

@@ -16,6 +16,8 @@ spec:
     scheme: https
     tlsConfig:
       caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
+      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
       serverName: server-name-replaced-at-runtime
   selector:
     matchLabels:

assets/kube-state-metrics/deployment.yaml

@@ -65,6 +65,7 @@ spec:
         - --upstream=http://127.0.0.1:8081/
         - --tls-cert-file=/etc/tls/private/tls.crt
         - --tls-private-key-file=/etc/tls/private/tls.key
+        - --client-ca-file=/etc/tls/client/client-ca.crt
         image: quay.io/brancz/kube-rbac-proxy:v0.9.0
         name: kube-rbac-proxy-main
         ports:
@@ -80,13 +81,17 @@ spec:
         - mountPath: /etc/tls/private
           name: kube-state-metrics-tls
           readOnly: false
+        - mountPath: /etc/tls/client
+          name: metrics-client-ca
+          readOnly: false
       - args:
         - --logtostderr
         - --secure-listen-address=:9443
         - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
         - --upstream=http://127.0.0.1:8082/
         - --tls-cert-file=/etc/tls/private/tls.crt
         - --tls-private-key-file=/etc/tls/private/tls.key
+        - --client-ca-file=/etc/tls/client/client-ca.crt
         image: quay.io/brancz/kube-rbac-proxy:v0.9.0
         name: kube-rbac-proxy-self
         ports:
@@ -102,6 +107,9 @@ spec:
         - mountPath: /etc/tls/private
           name: kube-state-metrics-tls
           readOnly: false
+        - mountPath: /etc/tls/client
+          name: metrics-client-ca
+          readOnly: false
       nodeSelector:
         kubernetes.io/os: linux
       priorityClassName: system-cluster-critical
@@ -113,3 +121,6 @@ spec:
       - name: kube-state-metrics-tls
         secret:
           secretName: kube-state-metrics-tls
+      - configMap:
+          name: metrics-client-ca
+        name: metrics-client-ca

assets/kube-state-metrics/service-monitor.yaml

@@ -24,6 +24,8 @@ spec:
     scrapeTimeout: 1m
     tlsConfig:
       caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
+      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
       serverName: server-name-replaced-at-runtime
   - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
     interval: 1m

assets/node-exporter/daemonset.yaml

@@ -63,6 +63,7 @@ spec:
         - --upstream=http://127.0.0.1:9100/
         - --tls-cert-file=/etc/tls/private/tls.crt
         - --tls-private-key-file=/etc/tls/private/tls.key
+        - --client-ca-file=/etc/tls/client/client-ca.crt
         env:
         - name: IP
           valueFrom:
@@ -87,6 +88,9 @@ spec:
         - mountPath: /etc/tls/private
           name: node-exporter-tls
           readOnly: false
+        - mountPath: /etc/tls/client
+          name: metrics-client-ca
+          readOnly: false
       hostNetwork: true
       hostPID: true
       initContainers:
@@ -139,6 +143,9 @@ spec:
           path: /var/log/wtmp
           type: File
         name: node-exporter-wtmp
+      - configMap:
+          name: metrics-client-ca
+        name: metrics-client-ca
   updateStrategy:
     rollingUpdate:
       maxUnavailable: 10%

assets/node-exporter/service-monitor.yaml

@@ -23,7 +23,9 @@ spec:
     scheme: https
     tlsConfig:
       caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
       insecureSkipVerify: false
+      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
       serverName: server-name-replaced-at-runtime
   jobLabel: app.kubernetes.io/name
   selector:

assets/prometheus-k8s/prometheus.yaml

@@ -198,6 +198,7 @@ spec:
   - prometheus-k8s-proxy
   - prometheus-k8s-thanos-sidecar-tls
   - kube-rbac-proxy
+  - metrics-client-certs
   securityContext:
     fsGroup: 65534
     runAsNonRoot: true

assets/prometheus-k8s/service-monitor-thanos-sidecar.yaml

@@ -17,6 +17,8 @@ spec:
     scheme: https
     tlsConfig:
       caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
+      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
       serverName: prometheus-k8s-thanos-sidecar
   selector:
     matchLabels:

assets/prometheus-k8s/service-monitor.yaml

@@ -16,6 +16,8 @@ spec:
     scheme: https
     tlsConfig:
       caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
+      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
       serverName: prometheus-k8s
   selector:
     matchLabels:

assets/prometheus-operator/deployment.yaml

@@ -60,6 +60,7 @@ spec:
         - --upstream=https://prometheus-operator.openshift-monitoring.svc:8080/
         - --tls-cert-file=/etc/tls/private/tls.crt
         - --tls-private-key-file=/etc/tls/private/tls.key
+        - --client-ca-file=/etc/tls/client/client-ca.crt
         - --upstream-ca-file=/etc/configmaps/operator-cert-ca-bundle/service-ca.crt
         image: quay.io/brancz/kube-rbac-proxy:v0.9.0
         name: kube-rbac-proxy
@@ -79,6 +80,9 @@ spec:
         - mountPath: /etc/configmaps/operator-cert-ca-bundle
           name: operator-certs-ca-bundle
           readOnly: false
+        - mountPath: /etc/tls/client
+          name: metrics-client-ca
+          readOnly: false
       nodeSelector:
         kubernetes.io/os: linux
         node-role.kubernetes.io/master: ""
@@ -96,3 +100,6 @@ spec:
       - configMap:
           name: operator-certs-ca-bundle
         name: operator-certs-ca-bundle
+      - configMap:
+          name: metrics-client-ca
+        name: metrics-client-ca

assets/prometheus-operator/service-monitor.yaml

@@ -16,6 +16,8 @@ spec:
     scheme: https
     tlsConfig:
       caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
+      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
       serverName: server-name-replaced-at-runtime
   selector:
     matchLabels:

assets/thanos-querier/service-monitor.yaml

@@ -16,6 +16,8 @@ spec:
     scheme: https
     tlsConfig:
       caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
+      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
       serverName: server-name-replaced-at-runtime
   selector:
     matchLabels:

assets/thanos-ruler/service-monitor.yaml

@@ -13,6 +13,8 @@ spec:
     scheme: https
     tlsConfig:
       caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
+      certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
+      keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
       serverName: server-name-replaced-at-runtime
   selector:
     matchLabels:

cmd/operator/main.go

@@ -203,7 +203,7 @@ func Main() int {
 
 	wg, ctx := errgroup.WithContext(ctx)
 
-	wg.Go(func() error { return o.Run(ctx.Done()) })
+	wg.Go(func() error { return o.Run(ctx) })
 
 	term := make(chan os.Signal)
 	signal.Notify(term, os.Interrupt, syscall.SIGTERM)

go.mod

@@ -7,9 +7,9 @@ require (
 	github.com/ghodss/yaml v1.0.0
 	github.com/gogo/protobuf v1.3.2
 	github.com/imdario/mergo v0.3.7
-	github.com/openshift/api v0.0.0-20210225162315-bae60f47eed7
-	github.com/openshift/client-go v0.0.0-20201214125552-e615e336eb49
-	github.com/openshift/library-go v0.0.0-20210113192829-cfbb3f4c80c2
+	github.com/openshift/api v0.0.0-20210706092853-b63d499a70ce
+	github.com/openshift/client-go v0.0.0-20210521082421-73d9475a9142
+	github.com/openshift/library-go v0.0.0-20210720093535-f8ed43828870
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus-operator/prometheus-operator v0.47.1
 	github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.48.1
@@ -24,7 +24,7 @@ require (
 	k8s.io/apiserver v0.21.2
 	k8s.io/client-go v12.0.0+incompatible
 	k8s.io/klog/v2 v2.8.0
-	k8s.io/kube-aggregator v0.20.0
+	k8s.io/kube-aggregator v0.21.1
 	k8s.io/metrics v0.19.4
 )